feat(azure): add opt-in Azure OpenAI scan support

[Alessio2405]

Maintainer tracking

Related to #52: Azure provider support overlaps endpoint configuration, but does not by itself resolve the broader custom-endpoint policy question.

Summary

Add opt-in Azure OpenAI API-key support to the standalone CLI and TypeScript SDK.

Azure is selected only through --azure-endpoint or the SDK azureOpenAI
configuration. Existing OpenAI, ChatGPT, and custom-provider behavior remains
unchanged when Azure is not explicitly configured.

• Support Azure OpenAI Responses v1 endpoints for scan and bulk-scan.
• Use AZURE_OPENAI_API_KEY and treat --model as the Azure deployment name.
• Preserve replay-safe Azure configuration across scan reruns without storing
  API keys or managed provider definitions.
• Keep the Azure key out of plugin-Python, workbench, bootstrap, and model-shell
  environments while supplying it to the parent Codex model process.
• Report Azure scan costs as unavailable and reject --max-cost/maxCostUsd
  instead of applying OpenAI pricing.
• Add endpoint validation, authentication, rerun, credential-isolation, cost,
  CLI, SDK, and legacy-compatibility regression coverage.
• Document Azure usage, authentication limitations, quota handling, and local
  security boundaries.

This initial integration supports API-key authentication only. Microsoft Entra
ID and managed identity are out of scope.

Validation

• pnpm run generate:models:check
• pnpm exec tsc --noEmit
• pnpm exec tsc -p tsconfig.build.json
• Prettier validation passed.
• Focused Azure and legacy-compatibility tests passed.
• Needs verifications with various configurations (i.e with Azure and gpt-5.4 sometimes I got error rate_limit_exceeded)

Example

export AZURE_OPENAI_API_KEY="<your-api-key>"

npx @openai/codex-security scan . \
  --azure-endpoint "https://my-resource.openai.azure.com" \
  --model "my-security-deployment"