OpenAI: Extract Model to use in permissions #149

The OpenAI provider does not yet support extracing model names.

In the authorizer flow, Provider::inspect_request is implemented for
the Anthropic / Bedrock / Gemini handlers (they decode the body to read
model), but the OpenAI chat-completion and responses handlers don't.
Result: request.model is None, so any non-* glob in
capability.models rejects every request to OpenAI.

The example works around it with "models": ["*"] for the OpenAI
provider and a comment in the README. A small inspect_request impl on
the OpenAI handler would be a nice follow-up — I can take a stab if it's
something you'd accept.

Ref: #145 (comment)