[AIENG-679] Unify GitHub Actions OIDC onto the generic OIDC flow

[gokul-cloudbees]

Summary

Routes GitHub Actions OIDC through the same generic flow used for Jenkins. The legacy path is preserved behind an explicit opt-in.

Changes

• New env var SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH=1. CLI fetches the runner's id-token with audience=https://app.cloudbees.io/smart-tests and presents it as a plain OIDC bearer (same code path as SMART_TESTS_OIDC_TOKEN for Jenkins)
  • Legacy env var EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH=1 still works, but now: Fetches the id-token without an audience (as before).
    • Adds the GitHub-OIDC-Legacy: 1 header so Intake routes to the legacy verifier.
    • Prints a deprecation warning pointing at the migration doc.
  • Added OIDC_AUDIENCE_KEY for callers that need a non-default audience.