oidc: Refactor lookup strategies into single functions

[facutuesca]

This PR refactors the Trusted Publishing "lookup strategies" pattern into a single lookup_by_claims() method for each of the publishers.

Context

A strategy is a way of, given a set of OIDC claims, query the database for a matching Trusted Publisher. Concretely, a strategy is a function that takes a set of claims and returns a Query object. Each publisher has a list of these strategies, ordered from specific to general. When trying to find a Trusted Publisher, the more specific strategies are tried first, and if they fail the more general ones are tried.

For example, for the given set of claims for a GitHub OIDC token:

{
    "repository": "foo/bar",
    "job_workflow_ref": "foo/bar/.github/workflows/release.yml@refs/heads/main",
    "environment": "my_environment",
}

first we ran a strategy that tried to find publishers with exactly those values (in particular, environment==my_environment). If that strategy failed, we tried the second strategy, where we tried to find publishers with environment==None (that is, allowing any environment).
The "specific to general" order in this case meant going from "Publishers that only allow my_environment as an environment" to "Publishers that allow any environment".

New implementation

This PR changes the above approach to a single function per provider called lookup_by_claims() which takes a set of claims and returns a Publisher.

The multiple strategies are collapsed into a single query: we query for all publishers where the non-optional fields match the claims. In the example above, this means our single query looks for all publishers that match repository and job_workflow_ref, ignoring the environment value.

We then look at the resulting Python Publisher objects, and select the most specific one.

Rationale

The reasons for this change are:

• Removing the multiple lookup strategies, which are unnecessary since a single (general) query is enough
• Preparing for adding support for GitHub reusable workflows (as sketched in Trusted publishing: Support for GitHub reusable workflows #11096 (comment)).

cc @woodruffw @miketheman @di