[devcontainer] "secure" customer profile for devcontainer should be installable from Codex

What variant of Codex are you using?

CLI

What feature would you like to see?

Having a first-party devcontainer for isolation of Codex is very nice, but the config files for it are only available here in the repo, which does not really help any users.

My proposal here is for a new sub-command that is similar in syntax to the existing sandbox command called codex devcontainer. The command would then verify that the user has a Docker engine and @devcontainers/cli installed, extract the needed files from the codex executable to a .codex-devcontainer folder in the current directory, and launch the container.

Additional information

A rough draft of what I'm thinking can be seen here: https://github.com/ebendler/codex/commit/870fcd6e1e224f15d8d8ae7b3e63d4b1cf9abfdf