Fetch organization repositories with Workload Identity

[ericmj]

A repository request to a Hex.pm organization that resolves no other credentials now exchanges the CI job's OIDC token for a repository:ORG token. hexpm issues those to organization workload identities with the read or write role since hexpm/hexpm@a746876. Organization keys, HEX_REPOS_KEY and a user session still come first.

Build tools opt in with two new optional callbacks, get_workload_identity_token and persist_workload_identity_token, which keep the outcome of the last exchange for each repository in memory. Without them every request would exchange a new OIDC token, so a build tool that doesn't provide them resolves repository credentials as before.

• The exchange holds the repo lock, so concurrent requests share one token. A token is reused until it's within five minutes of expiring, and a token_expired 401 exchanges again unless another request already replaced the rejected token.
• A failed exchange is kept and not repeated, since hexpm counts failed exchanges against a limit per GitHub repository.
• After a failed exchange an optional request runs without credentials, as it would outside CI, so a mirror that authenticates another way still works. A 401 or 403 to that request, or a failed renewal, returns {error, {auth_error, {workload_identity_failed, Reason}}}.
• The jwt-bearer exchange now requires expires_in in the token response, which hexpm always sends. This applies to workload_identity_auth/2 too.