auth: Add GitHub OIDC auth (#278)

Adds support for auth'ing to the registry via [GitHub Actions
OIDC](https://docs.github.com/en/actions/concepts/security/openid-connect).

Fixes #271

## Motivation and Context

People will probably want to publish to the registry from CI
environments. DNS auth can work here fine
(https://github.com/modelcontextprotocol/registry/issues/270). But for
people who haven't set up DNS, the standard GitHub device flow won't
really work here. We could make this nice by supporting GitHub Actions
OIDC.

## How Has This Been Tested?

Tested locally with a real GitHub OIDC token from a personal repo.

## Breaking Changes

None

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

internal/auth/jwt_test.go

@@ -31,7 +31,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 
 	t.Run("generate and verify valid token", func(t *testing.T) {
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHub,
+			AuthMethod:        model.AuthMethodGitHubAT,
 			AuthMethodSubject: "testuser",
 			Permissions: []auth.Permission{
 				{
@@ -50,7 +50,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 		// Verify token
 		verifiedClaims, err := jwtManager.ValidateToken(ctx, tokenResponse.RegistryToken)
 		require.NoError(t, err)
-		assert.Equal(t, model.AuthMethodGitHub, verifiedClaims.AuthMethod)
+		assert.Equal(t, model.AuthMethodGitHubAT, verifiedClaims.AuthMethod)
 		assert.Equal(t, "testuser", verifiedClaims.AuthMethodSubject)
 		assert.Equal(t, "mcp-registry", verifiedClaims.Issuer)
 		assert.Len(t, verifiedClaims.Permissions, 1)
@@ -100,7 +100,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 			RegisteredClaims: jwt.RegisteredClaims{
 				ExpiresAt: jwt.NewNumericDate(time.Now().Add(-1 * time.Hour)), // Already expired
 			},
-			AuthMethod:        model.AuthMethodGitHub,
+			AuthMethod:        model.AuthMethodGitHubAT,
 			AuthMethodSubject: "testuser",
 		}
 
@@ -126,7 +126,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 		differentJWTManager := auth.NewJWTManager(differentCfg)
 
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHub,
+			AuthMethod:        model.AuthMethodGitHubAT,
 			AuthMethodSubject: "testuser",
 		}
 
@@ -149,7 +149,7 @@ func TestJWTManager_GenerateAndVerifyToken(t *testing.T) {
 
 	t.Run("multiple permissions", func(t *testing.T) {
 		claims := auth.JWTClaims{
-			AuthMethod:        model.AuthMethodGitHub,
+			AuthMethod:        model.AuthMethodGitHubAT,
 			AuthMethodSubject: "admin",
 			Permissions: []auth.Permission{
 				{