ci: authenticate to chainguard libraries with short-lived oidc tokens

[mbarretta]

CI has been failing since pyproject.toml switched Python resolution to libraries.cgr.dev — the workflows had no credentials for the index (401 from uv sync).

This wires up short-lived, OIDC-federated auth instead of a long-lived pull token:

• A Chainguard assumable identity (forge-ci-libraries, role libraries.python.pull only) is bound to this repo's GitHub Actions OIDC issuer; its ID is stored as the CHAINCTL_IDENTITY secret (Actions + Dependabot stores).
• Each uv sync job assumes the identity via chainguard-dev/setup-chainctl, mints a short-lived token with chainctl auth token --audience=libraries.cgr.dev, and exposes it to uv via UV_INDEX_CHAINGUARD_USERNAME/PASSWORD (masked).
• id-token: write added per job; no long-lived secrets anywhere.

Verified locally: uv lock --check resolves against the index using only the minted token (netrc isolated).

🤖 Generated with Claude Code