feat: bring back -s option to specify sandbox permissions

[bolinfest]

This PR updates core/src/approval_mode_cli_arg.rs to have a SandboxPermissionOption that we can include across our CLIs via:

#[clap(flatten)]
pub sandbox: SandboxPermissionOption,

I then updated our CLIs so that when Option<Vec<SandboxPermission>> is Some, the permissions are used to create the corresponding SandboxPolicy.

To test, I updated my ~/.codex/config.toml to be:

model = "o3"

approval_policy = "on-failure"

sandbox_permissions = [
    "disk-full-read-access",
    "disk-write-platform-user-temp-folder",
    "disk-write-platform-global-temp-folder",
    "disk-write-cwd",
]

And when I launch the TUI, the codex session details are as I expect:

Alternatively, I could also do:

cargo run -- -s disk-full-read-access -s disk-write-platform-user-temp-folder -s disk-write-platform-global-temp-folder -s disk-write-cwd 

---

Stack created with Sapling. Best reviewed with ReviewStack.

• feat: codex-linux-sandbox standalone executable #740
• -> feat: bring back -s option to specify sandbox permissions #739

[oai-ragona]

Nice! I like this a whole lot better than the inverse.