feat: introducing a network sandbox proxy

[viyatb-oai]

This add a new crate, codex-network-proxy, a local network proxy service used by Codex to enforce fine-grained network policy (domain allow/deny) and to surface blocked network events for interactive approvals.

• New crate: codex-rs/network-proxy/ (codex-network-proxy binary + library)
• Core capabilities:
  • HTTP proxy support (including CONNECT tunneling)
  • SOCKS5 proxy support
  • policy evaluation (allowed/denied domain lists; denylist wins; wildcard support)
  • small admin API for polling/reload/mode changes
  • optional MITM support for HTTPS CONNECT to enforce “limited mode” method restrictions
• Docs: docs/network-proxy-quickstart.md describing how to build/run the proxy locally and how to configure it

Will follow up integration with codex in subsequent PRs.

Testing

• cd codex-rs && cargo build -p codex-network-proxy
• cd codex-rs && cargo run -p codex-network-proxy -- proxy
• (optional) curl via HTTP_PROXY/HTTPS_PROXY as described in docs/network-proxy-quickstart.md

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[bolinfest]

Hmm, so these are intended to be relative paths?

[viyatb-oai]

yeah I meant this to have mitm/{cert} as a relative path to $CODEX_HOME - what would make the most sense since we support multiple places to have codex config