feat(approvals) RejectConfig for request_permissions (#14118)

## Summary
We need to support allowing request_permissions calls when using
`Reject` policy

<img width="1133" height="588" alt="Screenshot 2026-03-09 at 12 06
40 PM"
src="https://github.com/user-attachments/assets/a8df987f-c225-4866-b8ab-5590960daec5"
/>

Note that this is a backwards-incompatible change for Reject policy. I'm
not sure if we need to add a default based on our current use/setup

## Testing
- [x] Added tests
- [x] Tested locally

codex-rs/core/src/tools/runtimes/apply_patch.rs

@@ -218,6 +218,7 @@ mod tests {
             !runtime.wants_no_sandbox_approval(AskForApproval::Reject(RejectConfig {
                 sandbox_approval: true,
                 rules: false,
+                request_permissions: false,
                 mcp_elicitations: false,
             }))
         );
@@ -225,6 +226,7 @@ mod tests {
             runtime.wants_no_sandbox_approval(AskForApproval::Reject(RejectConfig {
                 sandbox_approval: false,
                 rules: false,
+                request_permissions: false,
                 mcp_elicitations: false,
             }))
         );

codex-rs/core/src/tools/sandboxing.rs

@@ -398,6 +398,7 @@ mod tests {
         let policy = AskForApproval::Reject(RejectConfig {
             sandbox_approval: true,
             rules: false,
+            request_permissions: false,
             mcp_elicitations: false,
         });
 
@@ -417,6 +418,7 @@ mod tests {
         let policy = AskForApproval::Reject(RejectConfig {
             sandbox_approval: false,
             rules: true,
+            request_permissions: false,
             mcp_elicitations: true,
         });