Factor out shared build, test, and release infrastructure

[handrews]

This PR (written by Codex with GPT 5.5; see last section below for details) factors the build system out of the OpenAPI-Specification repository so that it can be shared by other repositories, initially sig-security and sig-lifecycle (our existing repos that will produce SAF specifications). I'm not entirely sure how to review it, and am open to suggestions on any aspect of restructuring things in terms of commits or a series of PRs. (paging @ralfhandl )

What this does

I'm not going to explain it in detail because I want reviewers to ensure that the documentation is sufficient for that. However, the following goals have (hopefully) been accomplished:

• Consuming repositories no longer have any dependencies other than @oai/build-infra, which is installed from GitHub and should not ever be published to NPM. This eliminates the constant flood of dependabot PRs and their myriad downstream "sync from main/dev/etc." PRs that are constantly clogging the spec repo.
• Specification-specific information still lives in each spec repository in a config file.
• Most of the scripts directory in the OpenAPI-Specification have been replaced by this repository. The first commit in this repo shows where they moved, without any changes. Subsequent commits show what was changed.

How to review it

I don't personally think we need to review this in line-by-line detail. We're not about to release anything, and we can merge the downstream PRs in sig-security and sig-lifecycle first and make sure the CI all passes there before merging in OpenAPI-Specification,

To whatever extent you do want to review details, I recommend looking at the diffs commit-by-commit as I had Codex break the steps down a bit into incremental chunks, although some are still quite large.

This is on a branch in this repo instead of on my fork so that draft PRs in downstream repos can access the commit for their CI.

Codex's role and how to manage it

This is the first time I've posted AI-written code as a public PR. I chose to do this with AI because (as @ralfhandl and I have discussed), we've wanted something like this but no one wants to do it by hand. Ralf put in heroic amounts of work to get it to its current state in the OpenAPI-Specification repo as it is.

I chose Codex because of the models I've used fairly extensively (Claude Code Sonnet and Opus, Codex 5.5) it has consistently handled complex, vague instructions the best (although it looks like Claude Fable will outdo it significantly).

I'm still relatively new to Codex, so I only just now noticed that, unlike Claude, it writes extremely terse commit messages. I can fix that if it is a concern. [EDIT: I previously noted the lack of Codex putting itself as a co-author on the commits, but I fixed that when I fixed the CI issue]

[handrews]

Welp, first CI run failed, I'll get that sorted.

[handrews]

OK fixed- I also had Codex sign all commits as co-author, hence the force push (I assume no one reviewed this in the past 15 minutes anyway). The commit fixing the CI problem also documents the issue in CONTRIBUTING.md.

[handrews]

The previous fix involved platform-specific dependency installation issues. These further fixes ensure we don't have those issues in consumer repos, and updated documentation accordingly.