feat: custom API endpoint

[TomCN0803]

Summary

Allow users to point codex-security at a custom OpenAI-compatible LLM endpoint. #52

Changes

• CodexSecurityConfig now accepts optional endpoint field (src/config.ts)
• Passes baseUrl through to @openai/codex-sdk in api.ts
• openai_base_url whitelisted in scanPreflightCodexConfig so it survives --codex override sanitization
• New --endpoint CLI flag on scan and bulk-scan commands
• CODEX_ENDPOINT environment variable support (CLI flag takes priority)
• Tests for config, preflight sanitization, and parseCodexOverrides

Usage

# CLI flag
codex-security scan . --endpoint https://my-llm.example.com/v1

# Environment variable
CODEX_ENDPOINT=https://my-llm.example.com/v1 codex-security scan .

# Bulk scan
codex-security bulk-scan repos.csv --output-dir ./results --endpoint https://my-llm.example.com/v1

# Via --codex override
codex-security scan . --codex 'openai_base_url="https://my-llm.example.com/v1"'