Add Bazel repositories for pinned Codex releases (#40718)

## What changed

- Add a Bazel module extension that downloads checksum-pinned Linux x86-64 Codex release packages, with the Codex release host and GitHub Releases as sources.
- Generate `codex` and `package` filegroups from each package's `codex-package.json` manifest so consumers can address the entrypoint or the complete package contents.
- Register repositories for Codex `0.145.0` and `0.149.1` in `MODULE.bazel`.

GitOrigin-RevId: a73225bae76cf01a588c7e1b570f3fdd9f6e12ab