Use ESC secrets

[pgavlin]

These changes migrate this repo's GitHub Actions Workflows to use ESC secrets instead of GitHub Secrets.

The changes are largely mechanical:

• Common configuration for all ESC actions within a workflow is added to the workflow's environment variables
• Permissions are expanded as necessary for workflows that do not grant id-token: write permissions
  • read-all permissions are replaced with the union of all explicit read permissions and id-token: write
  • Default permissions are replaced with write-all, which is the equivalent of all explicit write permissions and
    id-token: write
  • Explicit permissions are modified to grant id-token: write
• A step that fetches ESC secrets and populates environment variables is added to each step that reads secrets
• Direct references to secrets within the job are replaced with references to the step's outputs

All ESC actions are configured to fetch secrets from a shared ESC environment that contains secrets migrated from GitHub Actions. The ESC action performs its own OIDC exchange to obtain a Pulumi Access Token.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 52.17%. Comparing base (f01d73c) to head (5ad27f2).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #895   +/-   ##
=======================================
  Coverage   52.17%   52.17%           
=======================================
  Files          33       33           
  Lines        4556     4556           
=======================================
  Hits         2377     2377           
  Misses       1986     1986           
  Partials      193      193           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[EronWright]

Thanks for the contribution, I'll take it from here and ship it in M121.