chore: put crypto provider logic in a shared crate (#11294)

Ensures a process-wide rustls crypto provider is installed.

Both the `codex-network-proxy` and `codex-api` crates need this.

codex-rs/network-proxy/src/proxy.rs

@@ -8,6 +8,7 @@ use crate::state::NetworkProxyState;
 use anyhow::Context;
 use anyhow::Result;
 use clap::Parser;
+use codex_utils_rustls_provider::ensure_rustls_crypto_provider;
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::net::TcpListener as StdTcpListener;
@@ -381,6 +382,8 @@ impl NetworkProxy {
             return Ok(NetworkProxyHandle::noop());
         }
 
+        ensure_rustls_crypto_provider();
+
         if !unix_socket_permissions_supported() {
             warn!("allowUnixSockets is macOS-only; requests will be rejected on this platform");
         }