[codex] Route Fed ChatGPT auth through Fed edge (#17151)

## Summary
- parse chatgpt_account_is_fedramp from signed ChatGPT auth metadata
- add _account_is_fedramp=true to ChatGPT backend-api requests only for
FedRAMP ChatGPT-auth accounts

codex-rs/core/src/agent_identity.rs

@@ -737,6 +737,7 @@ mod tests {
                     chatgpt_plan_type: None,
                     chatgpt_user_id: user_id.map(ToOwned::to_owned),
                     chatgpt_account_id: Some(account_id.to_string()),
+                    chatgpt_account_is_fedramp: false,
                     raw_jwt: fake_id_token(account_id, user_id),
                 },
                 access_token: format!("access-token-{account_id}"),

codex-rs/core/src/mcp_openai_file.rs

@@ -115,6 +115,7 @@ async fn build_uploaded_local_argument_value(
     let upload_auth = CoreAuthProvider {
         token: Some(token_data.access_token),
         account_id: token_data.account_id,
+        is_fedramp_account: auth.is_fedramp_account(),
     };
     let uploaded = upload_local_file(
         turn_context.config.chatgpt_base_url.trim_end_matches('/'),