ci: migrate Hub logins to OIDC

[ronan-thibaut-glitch]

Summary

Migrates the three Hub push jobs in ci.yml from PAT-based login (DOCKERPUBLICBOT) to short-lived OIDC tokens, using the OIDC connection pattern already established in other Docker org repositories.

Job	Change
build-and-push-image	job-level id-token: write, OIDC token exchange, login as docker with the exchanged token
merge-and-push-image	same
merge-and-push-template	same

Details

• Uses docker/oidc-action@b048fb0 (v1.1.0) with the current connection-id input (the connection_id form is deprecated in v1.x).
• The connection ID is read from the repository variable DOCKERHUB_OIDC_CONNECTION_ID, so the connection can be rotated without a code change.
• expires-in: 3600 (the maximum): the multi-arch digest builds with SBOM and provenance can outlive the 300 s default token TTL.
• The connection is scoped to pull and push on docker/docker-agent and docker/docker-agent-sbx-templates only, with subject claims restricted to this repository's main branch and v* tags.
• The job-level permissions blocks override the top-level contents: read for the three push jobs only. Artifact upload/download between jobs uses the runtime token and needs no extra permission.
• vars.DOCKERPUBLICBOT_USERNAME and secrets.DOCKERPUBLICBOT_WRITE_PAT are no longer referenced by this workflow.

Validation

• scripts/workflow-lint.sh passes (SHA pinning check covers the new action reference).
• The push jobs are gated on non-PR events, so PR CI exercises only the linters; the first push to main (edge tag) is the end-to-end proof. A workflow_dispatch from a branch other than main will fail the token exchange by design (no matching subject claim).
• Merge prerequisite: the DOCKERHUB_OIDC_CONNECTION_ID repository variable must exist before this lands, otherwise the token exchange fails on the next main push.