Add Actions OIDC provider with workflow permission gating

[lunny]

Ref: docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect

Fix #26383
Replace #25664

• Implement Actions OIDC issuer endpoints (.well-known, JWKS, token) and signed JWT issuance tied to runs/jobs.
• Introduce id-token permission parsing and enforcement for OIDC access, including owner/repo config clamping.
• Expose OIDC request URL/token in runner context and add OIDC claim generation plus integration tests.

---

Generated by a coding agent with Codex 5.2

[Menschomat]

@lunny in the current world full of supply chain attacks with credential stealers having the ability to use OIDC for e.g. workload identity federation would be awesome. Please guys, make this happen :)