Add OIDC authentication support to the Doppler provider

[coetzeevs]

Summary

Adds OpenID Connect (OIDC) authentication as a new provider authentication method, enabling keyless authentication from CI/CD platforms (GitHub Actions, GitLab CI, etc.) and Kubernetes workloads that issue OIDC tokens.

Changes

• API client (doppler/api.go): Add exchangeOIDCToken function that exchanges an OIDC JWT for a Doppler API token via the /v3/auth/oidc endpoint, with TLS 1.2 minimum, 30s timeout, and 1MB response size limit
• Provider configuration (doppler/provider.go): Add three new optional attributes:
  • oidc_identity — UUID of the Doppler service account identity (DOPPLER_OIDC_IDENTITY)
  • oidc_token — JWT token directly (DOPPLER_OIDC_TOKEN)
  • oidc_token_file — path to a file containing a JWT (DOPPLER_OIDC_TOKEN_FILE)
• Validation & security hardening (doppler/provider.go):
  • Mutual exclusivity between doppler_token and OIDC auth, and between oidc_token / oidc_token_file
  • Client-side UUID validation for oidc_identity
  • JWT structure check (3 dot-separated parts)
  • Absolute path requirement for oidc_token_file, with empty-file check
  • oidc_token marked Sensitive: true to prevent plan output leakage
  • Warnings for non-HTTPS hosts and disabled TLS verification
  • doppler_token changed from Required to Optional
• Documentation (templates/index.md.tmpl, docs/index.md): Document both OIDC authentication options with usage examples
• Example (examples/main.tf): Add commented-out OIDC provider configuration examples

Usage

# Using a token file (e.g. Kubernetes projected service account token)
provider "doppler" {
  oidc_identity   = "<YOUR SERVICE ACCOUNT IDENTITY UUID>"
  oidc_token_file = "/var/run/secrets/tokens/doppler"
}

# Or using a token directly
provider "doppler" {
  oidc_identity = "<YOUR SERVICE ACCOUNT IDENTITY UUID>"
  oidc_token    = "<YOUR OIDC JWT>"
}

Test plan

• make build compiles successfully
• make test passes
• make tfdocs produces docs consistent with templates (hash unchanged)
• No semgrep-prohibited patterns (exec.Command, ioutil.WriteFile)