feat(): add support for github provided jwt auth

[blz-ea]

This PR add support for Github provided JWT

Example Usage

#...
jobs:
  # ...
  build:
    permissions:
      id-token: write
      contents: read
    steps:
      # ...
      - name: Import Secrets
        id: secrets
        uses: hashicorp/vault-action
        with:
          url: https://vault.mycompany.com:8200
          method: jwt
          role: github-action
          secrets: |
              secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
              secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY

Example Github provided JWT

{
  "jti": "871e293a-7d48-466f-8f5f-e1713ae152cb",
  "sub": "repo:blz-ea/example-repo:ref:refs/heads/blz-ea-patch-1",
  "aud": "sigstore",
  "ref": "refs/heads/blz-ea-patch-1",
  "sha": "75829399ab789a6f927f6a7be1df283d4ee51e66",
  "repository": "blz-ea/example-repo",
  "repository_owner": "blz-ea",
  "run_id": "1262466604",
  "run_number": "19",
  "run_attempt": "2",
  "actor": "blz-ea",
  "workflow": "My Workflow Name",
  "head_ref": "",
  "base_ref": "",
  "event_name": "push",
  "ref_type": "branch",
  "job_workflow_ref": "blz-ea/example-repo/.github/workflows/test.yml@refs/heads/blz-ea-patch-1",
  "iss": "https://vstoken.actions.githubusercontent.com",
  "nbf": 1632324904,
  "exp": 1632325804,
  "iat": 1632325504
}

Example JWT Auth Config

{
  "jwt_validation_pubkeys" : [
    "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzW2j18tSka65aoPgmyk7\naUkYE7MmO8z9tM/HoKVJ+w/alYIknkf7pgBeWWfqRgkRfmDuJa8hATL20+bD9cQZ\n8uVAG1reQfIMxqxwt3DA6q37Co41NdgZ0MUTTQpfC0JyDbDwM/ZIzis1cQ1teJcr\nPBTQJ3TjvyBHeqDmEs2ZCmGLuHZloep8Y/4hmMBfMOFkz/7mWH7NPuhOLWnPTIKx\nnMuHl4EVdNL6CvIYEnzF24m/pf3IEM84vszL2s6+X7AbFheZVig8WqhEwiVjbUVx\nXcY4PtbK0z3jhgxcpjc6WTH0JlRedpq2ABowWZg+pxOoWZUAETfj6qBlbIn/F9kp\nyQIDAQAB\n-----END PUBLIC KEY-----"
  ],
  "bound_issuer": "https://vstoken.actions.githubusercontent.com"
}

Example JWT Role

{
  "role_type": "jwt",
  "bound_audiences": [ "sigstore" ],
  "policies": [
    "github-action"
  ],
  "token_explicit_max_ttl": 60,
  "bound_claims": {
    "repository": "*"
   },
  "subject_claim": "repository",
  "groups_claim": "sha",
  "user_claim": "actor",
  "bound_claims_type": "glob"
}

Notice: Based on unreleased Github feature

[tvoran]

This is looking great! Left a couple of thoughts.

It would also be great if you could remove the changes to dist/index.js since we typically don't update that file until we do a release.

And it would be even better if this could be tested in the integrationTests, similar to the regular jwt auth.

[tvoran]

Works great! Thanks so much!