[codex] Sanitize proxy request hostnames

[madeye]

Summary

• route HTTP CONNECT and SOCKS5 request construction through shared hostname validation
• fall back to the destination IP when an SNI/DNS hostname contains unsafe bytes or invalid label structure
• add focused tests for safe hostname use and CRLF/control-hostname fallback

Validation

• cargo test connect_request
• cargo test proxy_hostname_validation
• cargo test
• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• git diff --check