[codex] [1/4] Add recommended plugin endpoint cache

[adaley-openai]

Summary

• Add authenticated parsing for /ps/plugins/suggested?scope=GLOBAL, including remote plugin and connector app identities.
• Validate, deduplicate, sort, and cap endpoint candidates before caching them by backend and account identity.
• Deduplicate concurrent cache misses and warm recommendations from the existing remote-installed-plugin refresh path used at startup and after account changes.
• Keep endpoint results model-invisible in this PR; failures and responses without enabled: true resolve to legacy mode.

Stack

• 1/3. Follow-up: [codex] [2/4] Generalize plugin suggestion presentation #28400 generalizes plugin suggestion presentation without activating endpoint recommendations.
• Final activation: [codex] [3/4] Activate endpoint plugin recommendations #27704.

Validation

• just test -p codex-core-plugins recommended_plugins
• just fix -p codex-core-plugins
• just fmt
• git diff --check