fix: reject non-default OpenAI base URL ports

[pragnyanramtha]

Summary

• require official OpenAI base URLs to use no explicit port or the default TLS port 443
• fail closed for malformed or out-of-range ports instead of raising from urlsplit(...).port
• add HTTPS and WSS regression coverage for :443, non-default :444, out-of-range :99999, and non-numeric :abc

Validation

• uv run pytest tests/models/test_openai_client_utils.py -q -> 12 passed
• uv run mypy src/agents/models/openai_client_utils.py tests/models/test_openai_client_utils.py -> passed
• uv run pyright src/agents/models/openai_client_utils.py tests/models/test_openai_client_utils.py -> passed
• make format -> passed during worker validation
• make lint -> passed during worker validation
• git diff --check -> passed

Full code-change-verification was attempted during worker validation, but the repository-wide typecheck/tests did not finish in this local environment after roughly 55 minutes. The focused helper tests and type checks above passed.