Add strict known marketplace requirements

[abhinav-oai]

Why

Enterprises need a managed way to restrict user-added plugin marketplaces to approved sources while keeping Codex's built-in catalogs available. This gives admins a source-based allowlist for marketplace installs without turning curated or backend catalogs into managed-config surface area.

What

• add a strict_known_marketplaces managed requirement with exact matching over source_type, normalized source, ref, and sparse_paths
• enforce the allowlist for configured user marketplaces when adding, discovering, installing from, and upgrading them
• keep openai-curated plus backend-provided catalogs intentionally outside this requirement, and document that boundary inline
• expose the requirement through configRequirements/read and regenerate the app-server schema/TypeScript fixtures

Verification

• cargo test -p codex-config deserialize_strict_known_marketplaces
• cargo test -p codex-core-plugins add_marketplace_sync_rejects_git_source_blocked_by_requirements_before_clone
• cargo test -p codex-core install_plugin_rejects_disallowed_configured_marketplace
• cargo test -p codex-app-server-protocol config_requirements
• cargo test -p codex-core-plugins -p codex-hooks