fix: sanitize provider imports from URLs

[superman2003]

Summary

• ignore untrusted configContents and authContents embedded in provider deep links
• rebuild relay config and auth files only from the visible structured provider fields
• strip file payloads from pending imports and explain the behavior in the confirmation dialog

Test plan

• cargo fmt --all -- --check
• cargo test -p codex-plus-core provider_import::tests -- --test-threads=1 (5 passed)
• cargo check -p codex-plus-core -j 1

Environment note

npm run check could not run because this checkout has no node_modules and tsc is not installed locally.