Implement GitHub Actions OIDC processing

[etvorun]

✨ Overview

This pull request introduces enhancements to the handling of federated credentials and token validation. The changes are meant to make the code easier to extend and support more identity providers like GitHub Actions

---

🔐 Token Validation Refactoring

• Interface Renaming & Extension
  Renamed ITokenValidator to ITokenPolicyValidator and extended it to support matching FederatedCredentialPolicy instances with incoming OIDC tokens.

• Entra ID Logic Isolation
  Renamed EntraIdTokenValidator to EntraIdTokenPolicyValidator and moved Entra ID-specific policy evaluation logic from FederatedCredentialPolicyEvaluator into this class.

• GitHub Actions Support
  Introduced GitHubTokenPolicyValidator to handle validation of GitHub Actions OIDC tokens and evaluate trusted publishing policies for GitHub.

• Evaluator Refactor
  Updated FederatedCredentialPolicyEvaluator to operate with a collection of ITokenPolicyValidator implementations, enabling support for multiple identity providers.

• API Key Generation Flow
  No changes were made to the API key generation process. Once an OIDC token is matched to a FederatedCredentialPolicy, the key generation logic remains consistent across providers.

---

🧠 Policy Evaluation Improvements

• Naming Clarity
  Renamed EvaluatedFederatedCredentialPolicies to OidcTokenEvaluationResult to reduce confusion with FederatedCredentialPolicyResult.

• Documentation Enhancements
  Added inline comments to both OidcTokenEvaluationResult and FederatedCredentialPolicyResult to clarify their roles and usage.

---

⚙️ Configuration Updates

• Audience Configuration
  Added FederatedCredentialConfiguration.NuGetAudience to support audience validation for tokens issued by publishers like GitHub Actions.

Addresses https://github.com/NuGet/Engineering/issues/5887

[Copilot]

Pull Request Overview

This pull request implements GitHub Actions OIDC processing and refactors the federated credential token validation system to support multiple identity providers. The changes introduce a new extensible architecture using the ITokenPolicyValidator interface, allowing the system to handle both Entra ID and GitHub Actions tokens.

Key Changes:

• Introduced ITokenPolicyValidator interface to support multiple identity providers through a common pattern
• Added GitHub Actions OIDC token validation and policy evaluation with GitHubTokenPolicyValidator
• Refactored existing Entra ID validation to use the new interface pattern with EntraIdTokenPolicyValidator

Reviewed Changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
GitHubTokenPolicyValidator.cs	New validator for GitHub Actions OIDC tokens with comprehensive policy evaluation
EntraIdTokenPolicyValidator.cs	Refactored Entra ID validator to implement new interface pattern
ITokenPolicyValidator.cs	New interface defining contract for token validation and policy evaluation
FederatedCredentialPolicyEvaluator.cs	Updated to work with multiple validators through the new interface
OidcTokenEvaluationResult.cs	New result type replacing EvaluatedFederatedCredentialPolicies
ServicesConstants.cs	Added NuGetAudience constant and converted string fields to const