[AIENG-679] Unify GitHub Actions OIDC onto the generic OIDC flow

[gokul-cloudbees]

Summary

Routes GitHub Actions OIDC through the same generic flow used for Jenkins. The legacy path is preserved behind an explicit opt-in.

Changes

• New env var SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH=1. CLI fetches the runner's id-token with audience=https://app.cloudbees.io/smart-tests and presents it as a plain OIDC bearer (same code path as SMART_TESTS_OIDC_TOKEN for Jenkins)
  • Legacy env var EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH=1 still works, but now: Fetches the id-token without an audience (as before).
    • Adds the GitHub-OIDC-Legacy: 1 header so Intake routes to the legacy verifier.
    • Prints a deprecation warning pointing at the migration doc.
  • Added OIDC_AUDIENCE_KEY for callers that need a non-default audience.

[ono-max]

Should we modify the Java part? I guess we need to do the same thing there, too.

smart-tests-cli/src/main/java/com/launchableinc/ingest/commits/Main.java

Lines 87 to 125 in c57ddb1

	/** Ensures all the configuration is properly in place. */
	private void parseConfiguration() throws CmdLineException {
	String apiToken = launchableToken;
	if (launchableToken == null) {
	apiToken = System.getenv("SMART_TESTS_TOKEN");
	}
	if (apiToken == null || apiToken.isEmpty()) {
	if (System.getenv("GITHUB_ACTIONS") != null) {
	String o = System.getenv("SMART_TESTS_ORGANIZATION");
	if (org == null && o == null) {
	throw new CmdLineException("SMART_TESTS_ORGANIZATION env variable is not set");
	}
	String w = System.getenv("SMART_TESTS_WORKSPACE");
	if (ws == null && w == null) {
	throw new CmdLineException("SMART_TESTS_WORKSPACE env variable is not set");
	}
	if (org == null) {
	this.org = o;
	}
	if (ws == null) {
	this.ws = w;
	}
	if (System.getenv("EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH") != null) {
	authenticator = new GitHubIdTokenAuthenticator();
	} else {
	authenticator = new GitHubActionsAuthenticator();
	}
	return;
	}
	throw new CmdLineException("SMART_TESTS_TOKEN env variable is not set");
	}
	this.parseLaunchableToken(apiToken);
	}

[ono-max]

This warning is within authentication_headers method, meaning that CLI will print it every time API is called. It might be annoyed, so can we think about a way to reduce the frequency?