config requirements: improve requirement error messages (#8843)

**Before:**
```
Error loading configuration: value `Never` is not in the allowed set [OnRequest]
```

**After:**
```
Error loading configuration: invalid value for `approval_policy`: `Never` is not in the
allowed set [OnRequest] (set by MDM com.openai.codex:requirements_toml_base64)
```

Done by introducing a new struct `ConfigRequirementsWithSources` onto
which we `merge_unset_fields` now. Also introduces a pair of requirement
value and its `RequirementSource` (inspired by `ConfigLayerSource`):

```rust
pub struct Sourced<T> {
    pub value: T,
    pub source: RequirementSource,
}
```

codex-rs/core/src/config_loader/macos.rs

@@ -1,4 +1,6 @@
 use super::config_requirements::ConfigRequirementsToml;
+use super::config_requirements::ConfigRequirementsWithSources;
+use super::config_requirements::RequirementSource;
 use base64::Engine;
 use base64::prelude::BASE64_STANDARD;
 use core_foundation::base::TCFType;
@@ -13,6 +15,13 @@ const MANAGED_PREFERENCES_APPLICATION_ID: &str = "com.openai.codex";
 const MANAGED_PREFERENCES_CONFIG_KEY: &str = "config_toml_base64";
 const MANAGED_PREFERENCES_REQUIREMENTS_KEY: &str = "requirements_toml_base64";
 
+pub(super) fn managed_preferences_requirements_source() -> RequirementSource {
+    RequirementSource::MdmManagedPreferences {
+        domain: MANAGED_PREFERENCES_APPLICATION_ID.to_string(),
+        key: MANAGED_PREFERENCES_REQUIREMENTS_KEY.to_string(),
+    }
+}
+
 pub(crate) async fn load_managed_admin_config_layer(
     override_base64: Option<&str>,
 ) -> io::Result<Option<TomlValue>> {
@@ -47,21 +56,26 @@ fn load_managed_admin_config() -> io::Result<Option<TomlValue>> {
 }
 
 pub(crate) async fn load_managed_admin_requirements_toml(
-    target: &mut ConfigRequirementsToml,
+    target: &mut ConfigRequirementsWithSources,
     override_base64: Option<&str>,
 ) -> io::Result<()> {
     if let Some(encoded) = override_base64 {
         let trimmed = encoded.trim();
-        if !trimmed.is_empty() {
-            target.merge_unset_fields(parse_managed_requirements_base64(trimmed)?);
+        if trimmed.is_empty() {
+            return Ok(());
         }
+
+        target.merge_unset_fields(
+            managed_preferences_requirements_source(),
+            parse_managed_requirements_base64(trimmed)?,
+        );
         return Ok(());
     }
 
     match task::spawn_blocking(load_managed_admin_requirements).await {
         Ok(result) => {
             if let Some(requirements) = result? {
-                target.merge_unset_fields(requirements);
+                target.merge_unset_fields(managed_preferences_requirements_source(), requirements);
             }
             Ok(())
         }