OIDC support

Add OpenID Connect (OIDC) support so Trigger.dev jobs can obtain short-lived, workload-scoped credentials from cloud providers and secret managers at runtime, instead of relying on long-lived static secrets.

This enables securely pulling secrets (e.g. from AWS, GCP, Azure, Vault) using identity-based access tied to the job or environment, reducing secret sprawl, simplifying rotation, and improving security posture for production workloads.