Add pattern matching for MITM hooks

[evawong-oai]

Summary

1. Add explicit pattern matching for MITM hook path, query, and header constraints.
2. Keep literal matching as the default and require pattern: for wildcard style matching.
3. Keep literal: as the escape when a value starts with a reserved prefix.
4. Document the exact TOML shape and matcher semantics in the proxy README.

Scope

1. This PR stays within MITM hook request matching on top of codex/mitm-proxy-landing.
2. It does not add secret sourcing, trust distribution, feature gating, or platform rollout work.
3. It also carries the minimal inherited test callsite comment fixes needed to unblock argument comment lint on this stacked branch.

Safety

1. Path matching keeps segment boundaries, so * and ? do not cross /.
2. Invalid pattern syntax fails during hook compilation before activation.
3. Literal values that start with pattern: can still be expressed with literal:.

Validation

1. cargo fmt --all
2. git diff --check
3. cargo test -p codex-network-proxy