feat(guardian): include connected account email in app reviews (#27045)

## Why

auto review reviews Codex App tool calls using connector metadata such
as the app ID, name, and description. That metadata does not identify
the account behind the OAuth connection.

For Google Drive, this means auto review cannot distinguish a Drive
connection authenticated as `user@email.com` from a personal Drive
account. Uploading work data can therefore look like a transfer to a
personal destination even though the connector service already knows the
authenticated account email.

## What changed

- Read `_meta._codex_apps.connected_account_email` while resolving
approval metadata for built-in Codex App tools.
- Include the connected account email in the structured MCP tool action
sent to auto review.
- Trim empty values and omit the field when the connector link has no
account email.
- Update existing auto review request constructors and add coverage for
request construction and JSON serialization.

## Security

Only metadata from the trusted built-in `codex_apps` MCP server is
accepted. Custom MCP servers cannot inject a connected account email
into auto review reviews; the new regression test verifies that spoofed
metadata is ignored.

The email is used only in auto review's private review request. This
change does not add it to model-visible tool descriptions, app-server
approval events, or auto review assessment/review analytics.

codex-rs/core/src/session/mcp.rs

@@ -621,6 +621,7 @@ fn guardian_elicitation_review_request(
                 meta,
                 MCP_ELICITATION_CONNECTOR_DESCRIPTION_KEY,
             ),
+            connected_account_email: None,
             tool_title: metadata_owned_string(meta, MCP_ELICITATION_TOOL_TITLE_KEY),
             tool_description: metadata_owned_string(meta, MCP_ELICITATION_TOOL_DESCRIPTION_KEY),
             annotations: None,

codex-rs/core/src/session/mcp_tests.rs

@@ -61,6 +61,7 @@ fn guardian_elicitation_review_request_builds_mcp_tool_call() {
         connector_id,
         connector_name,
         connector_description,
+        connected_account_email,
         tool_title,
         tool_description,
         annotations,
@@ -76,6 +77,7 @@ fn guardian_elicitation_review_request_builds_mcp_tool_call() {
     assert_eq!(connector_id.as_deref(), Some("browser-use"));
     assert_eq!(connector_name.as_deref(), Some("Browser Use"));
     assert_eq!(connector_description, None);
+    assert_eq!(connected_account_email, None);
     assert_eq!(tool_title.as_deref(), Some("Access browser origin"));
     assert_eq!(tool_description, None);
     assert_eq!(annotations, None);