Add trusted publishers

[segiddins]

For now, only supports GH Actions. Guides in rubygems/guides#348. Heavily inspired by PyPi's trusted publisher feature (https://docs.pypi.org/trusted-publishers/).

UI demo:

https://docs.google.com/document/d/1iJBiH4xSx9ZqvwQpeWu8fzb8UjrwV3Ta7M7azXKtJhA/edit?usp=sharing

[codecov]

Codecov Report

Attention: 4 lines in your changes are missing coverage. Please review.

Comparison is base (05f6813) 98.67% compared to head (89a8202) 98.71%.

Files	Patch %	Lines
...lers/oidc/pending_trusted_publishers_controller.rb	96.00%	1 Missing ⚠️
...lers/oidc/rubygem_trusted_publishers_controller.rb	97.29%	1 Missing ⚠️
app/helpers/rubygems_helper.rb	83.33%	1 Missing ⚠️
app/models/oidc/trusted_publisher/github_action.rb	98.59%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4239      +/-   ##
==========================================
+ Coverage   98.67%   98.71%   +0.04%     
==========================================
  Files         306      330      +24     
  Lines        6889     7340     +451     
==========================================
+ Hits         6798     7246     +448     
- Misses         91       94       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[martinemde]

Lots to read. Here's a first pass at the controllers mostly.

[martinemde]

Looks great, impressive work. I like how the controllers look now. They look much more canonical and are easier to read. I'm excited to see this feature in action.

[indirect]

it worked! when we are announcing and publicizing this, can we also publish a streamlined GitHub action, so our docs/examples can look something like this:

jobs:
  push:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
    - uses: actions/checkout@v4
    - uses: ruby/setup-ruby@v1
    - uses: rubygems/release@v1

Moving all of the steps inside our first-party action also means that we can update the code that our clients are running if necessary.