internal/oidc, test: ambient credentials, refactoring

[woodruffw]

Signed-off-by: William Woodruff [email protected]

Summary

Refactors sigstore._internal.oidc into a structured (directory) module and adds sigstore._internal.oidc.ambient for ambient credential detection. See #31.

Ticket Link

See #31. Does not close, since other detectors are needed.

[woodruffw]

N.B.: I also moved OAuth flow support into its own module (sigstore._internal.oidc.oauth) to keep the top-level relatively clean.

[tetsuo-cpp]

LGTM! I think it'd be good to get this in now since I have some changes that need to go on top of the oauth module.

@woodruffw I'll follow up with a change to amend the release workflow to use this.

[woodruffw]

I'll follow up with a change to amend the release workflow to use this.

Sounds good!

[woodruffw]

We don't need to address this in this PR, but I think Optional[Identity] would be a better signature here -- that way we could assert our validity guarantees about the token (e.g. having the right audience and being issued by a party we know).

Thoughts @tetsuo-cpp?

[woodruffw]

(If we were to do this, we should also refactor our top-level sign API to take an Identity instead of constructing one internally.)

[tetsuo-cpp]

Yeah I think that's a good idea. I'm going to take a stab at #4 in the coming days so it might be good to tackle it then so we get the interfaces right.