fix: Revert danger-full-access denylist-only mode (#17732)

## Summary

- Reverts openai/codex#16946 and removes the danger-full-access
denylist-only network mode.
- Removes the corresponding config requirements, app-server
protocol/schema, config API, TUI debug output, and network proxy
behavior.
- Drops stale tests that depended on the reverted mode while preserving
newer managed allowlist-only coverage.

## Verification

- `just write-app-server-schema`
- `just fmt`
- `cargo test -p codex-config network_requirements`
- `cargo test -p codex-core network_proxy_spec`
- `cargo test -p codex-core
managed_network_proxy_decider_survives_full_access_start`
- `cargo test -p codex-app-server map_requirements_toml_to_api`
- `cargo test -p codex-tui debug_config_output`
- `cargo test -p codex-app-server-protocol`
- `just fix -p codex-config -p codex-core -p codex-app-server-protocol
-p codex-app-server -p codex-tui`
- `git diff --cached --check`

Not run: full workspace `cargo test` (repo instructions ask for
confirmation before that broader run).

codex-rs/core/src/plugins/discoverable_tests.rs

@@ -201,13 +201,16 @@ async fn list_tool_suggest_discoverable_plugins_does_not_reload_marketplace_per_
 
     let logs = String::from_utf8(buffer.lock().expect("buffer lock").clone()).expect("utf8 logs");
     assert_eq!(logs.matches("ignoring interface.defaultPrompt").count(), 2);
+    let normalized_logs = logs.replace('\\', "/");
     assert_eq!(
-        logs.matches("build-ios-apps/.codex-plugin/plugin.json")
+        normalized_logs
+            .matches("build-ios-apps/.codex-plugin/plugin.json")
             .count(),
         1
     );
     assert_eq!(
-        logs.matches("life-science-research/.codex-plugin/plugin.json")
+        normalized_logs
+            .matches("life-science-research/.codex-plugin/plugin.json")
             .count(),
         1
     );