Enable additional identity providers for machine accounts (GitHub Actions enablement)

[evankanderson]

Summary

This cleans up #4317, and enables additional service account (machine identity) providers in internal/auth, starting with GitHub Actions. It's possible that this could be generalized to AWS, GCP, etc service accounts, but I wanted to start with a concrete example which enabled a number of other stories.

Usage (from #4317):

• make run-docker and set up KeyCloak with GitHub authentication
• minder auth login as a human to create a project
• Set up ngrok for port-forwarding, and update minder config with forwarding values for GitHub webhooks (optional)
• Run minder project role grant -s githubactions/repo:evankanderson/actions-id-token-testing:ref:refs/heads/main -r admin or the equivalent with your own repo.
• Set up a workflow to install the minder client, generate a minder token (see Add support for fetching and using a GitHub Actions OIDC token #5146 for a nicer version), and then run minder ruletype apply ...: https://github.com/evankanderson/actions-id-token-testing/actions/runs/13045189954/job/36394499683

Fixes #5145

Change Type

Mark the type of change your PR introduces:

• Bug fix (resolves an issue without affecting existing features)
• Feature (adds new functionality without breaking changes)
• Breaking change (may impact existing functionalities or require documentation updates)
• Documentation (updates or additions to documentation)
• Refactoring or test improvements (no bug fixes or new functionality)

Testing

Added unit tests for new modules, and tested manually.

Review Checklist:

• Reviewed my own code for quality and clarity.
• Added comments to complex or tricky code sections.
• Updated any affected documentation.
• Included tests that validate the fix or feature.
• Checked that related changes are merged.

[evankanderson]

Sorry about the size of the diff! I tried not to make it too large, but also not to leave too many things half-way (unlike #4317, which explicitly did that)

[evankanderson]

I removed this because an ID token with a sub but without the iss context seems dangerous, so I'd prefer to have our code explicitly get auth.Identity objects and reason about them.

[evankanderson]

(Fixed lint and hopefully test failures)

[evankanderson]

#5386 may help with the "unit test" leg of PRs timing out.