Use Docker Hub OIDC for Docker image publishing

[arturcic]

Goal

Replace the long-lived Docker Hub credentials used by publishing workflows with Docker Hub OIDC authentication.

Scope

• Configure a Docker Hub OIDC connection for the GitTools/GitVersion GitHub Actions publisher identity.
• Grant id-token: write only to the publishing jobs that need Docker Hub authentication.
• Update Docker Hub image publishing and manifest publishing to use docker/login-action OIDC support (DOCKERHUB_OIDC_CONNECTIONID) rather than gittools/cicd/dockerhub-creds and OP_SERVICE_ACCOUNT_TOKEN.
• Update Docker Hub README publishing to obtain and use a short-lived OIDC-issued Docker token.
• Remove the obsolete Docker Hub credential plumbing and secrets once all publishing paths are verified.

Acceptance criteria

• Release publishing can push all GitVersion images and manifests to Docker Hub without a static Docker Hub PAT/password.
• Docker Hub README publishing succeeds using the OIDC-issued token.
• The OIDC connection is restricted to the expected GitHub repository, workflow, and publishing ref/environment.
• No Docker Hub long-lived credential remains in the workflows or repository secrets.

References

• Docker Hub OIDC login support docker/login-action#1048
• https://docs.docker.com/enterprise/security/oidc-connections/