oidc-login in CI

[Copilot]

Ports score-compose#531: replaces long-lived DOCKER_HUB_TOKEN with short-lived OIDC tokens via docker/oidc-action for Docker Hub authentication in CI.

Changes — run-tests-on-pr.yml

• scan-container job: add id-token: write permission; insert Get Docker token step before both docker login steps; switch password: to ${{ steps.docker_oidc.outputs.token }}
• test-container job: same pattern — add explicit permissions block with id-token: write, OIDC token step, and updated docker login

- name: Get Docker token
  id: docker_oidc
  uses: docker/oidc-action@3f002d200df5620744c973221788e401898c6f86 # v1.0.0
  with:
    connection_id: ${{ secrets.DOCKER_HUB_CI_OIDC_CONNECTION_ID }}
- name: docker login docker.io
  uses: docker/login-action@...
  with:
    username: ${{ secrets.DOCKER_HUB_USERNAME }}
    password: ${{ steps.docker_oidc.outputs.token }}

Note: The DOCKER_HUB_CI_OIDC_CONNECTION_ID secret must be configured in the repository settings. The test-multi-arch-build reusable-workflow job is unchanged (same as the upstream PR).