auth: support OIDC trusted publishing

[benibenj]

What changed

• add an explicit vsce publish --oidc authentication mode
• request a GitHub Actions OIDC token for the marketplace.visualstudio.com audience
• exchange the OIDC token at POST /_apis/gallery/token
• pass the returned short-lived credential through the existing PAT-backed publish path
• keep token-provider acquisition extensible for future OIDC providers
• reject conflicting authentication methods and never silently fall back to a PAT
• document the GitHub Actions workflow setup and add focused tests

Why

Trusted publishing removes long-lived PAT secrets from CI pipelines. GitHub Actions is the first supported provider, while the provider abstraction allows additional OIDC runtimes to be added without changing the Marketplace exchange or publish paths.

Validation

• npm run build
• npm test -- --grep "OIDC trusted publishing" (6 passing)
• CLI authentication conflict check
• existing affected packaging tests rerun independently