oidc-login in CI

[mathieu-benoit]

https://github.com/docker/oidc-action is now GA, let's use it to improve the security posture of the CI pipeline now using oidc instead of long live static token to login to Docker Hub.

[github-actions]

Overview

Image reference	score-compose:latest	score-compose:latest
- digest	31cdcc76b72a	8d903b73a2a9
- tag	latest	latest
- provenance	03c3ddb	cc94cf3
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	6.3 MB	6.3 MB (+1 B)
- packages	54	54

Policies (0 improved, 0 worsened)

Policy Name	score-compose:latest	score-compose:latest	Change	Standing
Default non-root user	✅	✅		No Change
No copyleft licenses	⚠️ 2	⚠️ 2		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	⚠️	⚠️		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (1 package changes and 0 vulnerability changes)

• ♾️ 1 packages changed
• 53 packages unchanged

Changes for packages of type golang (1 changes)

	Package	Version score-compose:latest	Version score-compose:latest
♾️	github.com/score-spec/score-compose	0.0.0-20260720202700-03c3ddbc4145+dirty	0.0.0-20260721215623-cc94cf35a918+dirty

[mathieu-benoit]

Even if there is improvement coming docker/login-action#1048, I'll go ahead and merge this first step, and will update in a future PR accordingly for the broader integration into docker/login-action and docker/github-builder.