Hide unsupported MCP bearer_token from config schema

[etraut-openai]

Summary

Fixes #19275.

Codex runtime rejects inline MCP bearer_token config entries and asks users to configure bearer_token_env_var instead, but the generated config schema still advertised mcp_servers.<name>.bearer_token as a supported field. That made editor/schema validation disagree with runtime validation.

This keeps bearer_token in RawMcpServerConfig so Codex can continue producing the targeted runtime error for recent or existing configs, but skips the field during schemars generation. The checked-in core/config.schema.json fixture now exposes bearer_token_env_var without exposing unsupported inline bearer_token.

Verification

• Added config_schema_hides_unsupported_inline_mcp_bearer_token to assert the generated schema hides bearer_token while preserving bearer_token_env_var.
• Ran cargo test -p codex-config.
• Ran cargo test -p codex-core config_schema.

[chanwooyang1]

Thanks for the quick fix! The PR scope matches the schema/runtime mismatch I was seeing.