Support custom CA bundle per model provider

What feature would you like to see?

## Problem
In corporate networks, the model gateway uses a private CA chain. Codex (Rust/reqwest) on macOS trusts only the system Keychain, and there is no
way to pass a custom CA like curl --cacert. Without sudo, I cannot install the root CA into the System keychain, so TLS fails and Codex errors
with:
stream disconnected before completion: error sending request ...

## Request
Allow configuring a custom CA bundle in config.toml (or via env var) for a specific model provider, so Codex can work without modifying system
trust.

## Example config
```toml
model_provider = "glm"
model = "GLM-4.7"

[model_providers.glm2]
name = "GLM"
base_url = "https://xx/glm-2/v1"
env_key = "GLM_API_KEY"
wire_api = "chat"
ca_certificate = "/Users/xxx/certs/xx.pem"

(Optional: allow a global ca_certificate or CODEX_CA_BUNDLE=/path/to/ca.pem.)

Additional information

• macOS, no sudo to install System keychain certs
• curl --cacert works against the gateway, Codex does not
• The cert chain is private (root + intermediate)