[codex] Route Fed ChatGPT auth through Fed edge (#17151)

## Summary
- parse chatgpt_account_is_fedramp from signed ChatGPT auth metadata
- add _account_is_fedramp=true to ChatGPT backend-api requests only for
FedRAMP ChatGPT-auth accounts

codex-rs/codex-api/src/api_bridge.rs

@@ -179,6 +179,7 @@ struct UsageErrorBody {
 pub struct CoreAuthProvider {
     pub token: Option<String>,
     pub account_id: Option<String>,
+    pub is_fedramp_account: bool,
 }
 
 impl CoreAuthProvider {
@@ -196,6 +197,7 @@ impl CoreAuthProvider {
         Self {
             token: token.map(str::to_string),
             account_id: account_id.map(str::to_string),
+            is_fedramp_account: false,
         }
     }
 }
@@ -212,5 +214,8 @@ impl ApiAuthProvider for CoreAuthProvider {
         {
             let _ = headers.insert("ChatGPT-Account-ID", header);
         }
+        if self.is_fedramp_account {
+            crate::auth::add_fedramp_routing_header(headers);
+        }
     }
 }