chore: put crypto provider logic in a shared crate (#11294)

Ensures a process-wide rustls crypto provider is installed.

Both the `codex-network-proxy` and `codex-api` crates need this.

codex-rs/utils/rustls-provider/BUILD.bazel

@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "rustls-provider",
+    crate_name = "codex_utils_rustls_provider",
+)

codex-rs/utils/rustls-provider/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "codex-utils-rustls-provider"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+rustls = { workspace = true }

codex-rs/utils/rustls-provider/src/lib.rs

@@ -0,0 +1,12 @@
+use std::sync::Once;
+
+/// Ensures a process-wide rustls crypto provider is installed.
+///
+/// rustls cannot auto-select a provider when both `ring` and `aws-lc-rs`
+/// features are enabled in the dependency graph.
+pub fn ensure_rustls_crypto_provider() {
+    static RUSTLS_PROVIDER_INIT: Once = Once::new();
+    RUSTLS_PROVIDER_INIT.call_once(|| {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+    });
+}