OIDC support for short-lived API keys

[indirect]

RFC document for OIDC support

Existing OIDC providers:

• GitHub (docs at Configuring OpenID Connect in cloud providers)

Potential future OIDC providers:

• GitLab (docs at Connect to cloud services | GitLab)
• ??? (suggest services to us if you know of any)

Subtasks, each expected to need one or more tickets and PRs of their own:

• Build support for OIDC providers, API key roles, and access policies for JWT tokens (Allow using OIDC to fetch api tokens #3716)
• Create web UI for viewing and managing providers, API key roles, and access policies (in branch oidc-api-tokens) Add HTML pages for OIDC resources under /profile/ #4136
• Write OIDC API reference guide (Write reference documentation for OIDC API tokens #4127)

Planned future work, outside the scope of this ticket:

• Implement a streamlined user experience for gem authors publishing from GitHub
• Write guide documentation, walking a hypothetical user with a gem hosted on GitHub through each step (with screenshots), showing them how to publish their gem automatically via GitHub actions using a short-lived OIDC token

[segiddins]

Filed https://gitlab.com/gitlab-org/gitlab/-/issues/428061 about gitlab's openid-configuration