app-server: propagate nested experimental gating for AskForApproval::Reject

[dylan-hurd-oai]

Summary

This change makes AskForApproval::Reject gate correctly anywhere it appears inside otherwise-stable app-server protocol types.

Previously, experimental gating for approval_policy: Reject was handled with request-specific logic in ClientRequest detection. That covered a few request params types, but it did not generalize to other nested uses such as ProfileV2, Config, ConfigReadResponse, or ConfigRequirements.

This PR replaces that ad hoc handling with a generic nested experimental propagation mechanism.

Testing

seeing this when run app-server-test-client without experimental api enabled:

 initialize response: InitializeResponse { user_agent: "codex-toy-app-server/0.0.0 (Mac OS 26.3.1; arm64) vscode/2.4.36 (codex-toy-app-server; 0.0.0)" }
> {
>   "id": "50244f6a-270a-425d-ace0-e9e98205bde7",
>   "method": "thread/start",
>   "params": {
>     "approvalPolicy": {
>       "reject": {
>         "mcp_elicitations": false,
>         "request_permissions": true,
>         "rules": false,
>         "sandbox_approval": true
>       }
>     },
>     "baseInstructions": null,
>     "config": null,
>     "cwd": null,
>     "developerInstructions": null,
>     "dynamicTools": null,
>     "ephemeral": null,
>     "experimentalRawEvents": false,
>     "mockExperimentalField": null,
>     "model": null,
>     "modelProvider": null,
>     "persistExtendedHistory": false,
>     "personality": null,
>     "sandbox": null,
>     "serviceName": null
>   }
> }
< {
<   "error": {
<     "code": -32600,
<     "message": "askForApproval.reject requires experimentalApi capability"
<   },
<   "id": "50244f6a-270a-425d-ace0-e9e98205bde7"
< }
[verified] thread/start rejected approvalPolicy=Reject without experimentalApi