ci: authenticate runtime tests with OIDC instead of a stored API key - #6798

The runtime integration tests drop FELDERA_API_KEY_CI_GKE_AMD64 and FELDERA_API_KEY_CI_GKE_ARM64. The job presents its GitHub OIDC token as the bearer credential, which each CI instance matches against a registered trust relationship, and the auth step confirms the instance accepts it before the suites start.

testutils hands the SDK a callable rather than a token string when it runs under Actions. An ID token expires well inside a 50-minute test run, and the SDK re-resolves a callable per request and retries once on 401, so a token that lapses mid-run is replaced instead of failing every request after it.

The suites also drop FELDERA_TLS_INSECURE, since the CI instances present publicly trusted certificates. test-integration-platform keeps it, talking to a docker service container over a self-signed certificate, and keeps creating an API key: that path is what covers key creation, against a local instance, so no cluster secret is involved.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The SDK resolves a callable credential before every request, so the provider as written asked GitHub for a token on every API call. A suite that polls in loops across parallel workers sends enough of those to be throttled, and it arrives as a connection timeout inside the client rather than as anything naming the token endpoint.

The token is now held until two minutes before its own expiry, which takes a 500-request run from 500 mints to one. An unreadable payload falls back to minting each time, so a token is never served past its expiry.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

Review feedback: name the units the cache and the refresh margin are measured in, say plainly what an unreadable payload does rather than referring to previous behaviour, and drop the asides about what a fixed credential cannot do and which credential wins.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>