[codex] support downstream key site and credential exclusions (#431)

* support downstream key site and credential exclusions

* skip electron binary download in non-desktop ci

* fix migrate partial-journal test for 0020

drizzle/0020_downstream_api_key_exclusions.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `downstream_api_keys` ADD `excluded_site_ids` text;
+--> statement-breakpoint
+ALTER TABLE `downstream_api_keys` ADD `excluded_credential_refs` text;

drizzle/meta/_journal.json

@@ -134,6 +134,13 @@
       "when": 1775058998448,
       "tag": "0019_proxy_logs_stream_timing",
       "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "6",
+      "when": 1775397600000,
+      "tag": "0020_downstream_api_key_exclusions",
+      "breakpoints": true
     }
   ]
 }