Add request permissions tool (#13092)

Adds a built-in `request_permissions` tool and wires it through the
Codex core, protocol, and app-server layers so a running turn can ask
the client for additional permissions instead of relying on a static
session policy.

The new flow emits a `RequestPermissions` event from core, tracks the
pending request by call ID, forwards it through app-server v2 as an
`item/permissions/requestApproval` request, and resumes the tool call
once the client returns an approved subset of the requested permission
profile.

codex-rs/app-server/tests/suite/v2/mod.rs

@@ -21,6 +21,7 @@ mod plugin_install;
 mod plugin_list;
 mod rate_limits;
 mod realtime_conversation;
+mod request_permissions;
 mod request_user_input;
 mod review;
 mod safety_check_downgrade;