fix(exec-server): reject websocket requests with Origin headers

[viyatb-oai]

Why

codex exec-server has a local WebSocket listener, but it did not apply the same browser-origin request handling as the app-server WebSocket transport. Requests that carry an Origin header should not be upgraded by this local transport, keeping both local WebSocket servers consistent and avoiding unexpected browser-initiated connections.

What changed

• Added an Axum middleware guard in codex-rs/exec-server/src/server/transport.rs that returns 403 Forbidden for requests carrying an Origin header.
• Added an integration test in codex-rs/exec-server/tests/websocket.rs that covers rejection of an Origin-bearing WebSocket handshake.
• Kept ordinary WebSocket clients unchanged: existing no-Origin initialization and process behavior remains covered by the crate tests.

Validation

• just test -p codex-exec-server test phase (186 passed; run outside the parent macOS sandbox so nested sandbox tests can execute)
• just clippy -p codex-exec-server