[codex] Handle git pagination flags by position

[iceweasel-oai]

Why

This is a follow-up to the Windows Git safe-command bypass fix for BUGB-15601. Git's global --paginate / -p flags can route output through a configured pager, so they should not be auto-approved as safe before the subcommand. At the same time, -p after read-only subcommands like log, diff, and show is the common patch-output flag, so treating every -p as unsafe would make ordinary read-only inspection commands prompt unnecessarily.

What Changed

• Split Git option safety matching into explicit global-option and subcommand-option lists.
• Treat global git --paginate ... and git -p ... as unsafe.
• Keep post-subcommand patch usage such as git log -p, git diff -p, and git show -p HEAD safe.
• Keep the pagination coverage with the shared Git safe-command implementation rather than the Windows wrapper tests.
• Remove the stale git_global_option_requires_prompt helper now that safe-command Git option matching owns the prompt-required lists.

Testing

• cargo test -p codex-shell-command

[evawong-oai]

Approved. Security review found no High issues caused by this PR.