Add selective retries for STS token exchange

[blalor]

Summary

The workload identity flow retries GitHub OIDC token retrieval, but @actions/http-client does not retry the POST to Google Security Token Service. A transient connection reset or socket timeout therefore ends authentication on the first failed exchange.

This change adds four bounded STS attempts with 100, 200, and 400 ms backoffs. Retries are limited to connection failures and HTTP 408, 429, 500, 502, 503, and 504 responses. HTTP 400, 401, 403, empty responses, and unknown errors fail without retrying.

Attempt diagnostics contain only the operation, STS hostname, status or classified error, and attempt count. The existing STS request and computed-audience debug messages were removed so these diagnostics do not include the OIDC assertion, returned access token, headers, credential data, service account, or workload identity provider resource.

Mocked tests cover each retryable HTTP status, connection errors, the uncoded @actions/http-client socket timeout, permanent HTTP failures, the four-attempt limit, and diagnostic redaction.