requirements.toml: support command/identity-only MCP allowlist rules without pinning a server name (parity with Claude Code allowedMcpServers)

What variant of Codex are you using?

CLI

What feature would you like to see?

Problem

requirements.toml can restrict MCP servers via [mcp_servers.<name>], but a
rule matches only if BOTH the server name (exact TOML key, no wildcard/regex)
AND the identity match. There is no way to write a single rule that allows
"any MCP server whose command/identity matches X, regardless of the config key".

Use case

Claude Code, Cursor, and VS Code already support this command-only model. Claude's
managed setting:

{
"allowedMcpServers": [
{
"serverCommand": [
...
]
}
]
}

One rule, no server name, never regenerated.

What Codex forces today

Because the name is a required exact key, we must pre-mint a fixed pool of names.

Request (any one of these solves it)

1. A wildcard server key, e.g. [mcp_servers."*"].identity = { command = ... }.
2. A top-level identity-only allowlist (list of allowed command/identity matchers,

name-agnostic) that a server passes if its identity matches ANY entry.

1. Allow regex/glob in the [mcp_servers.<name>] key.

Additional information

_No response_