Migrate CI AWS auth to OIDC

[willronchetti]

Summary

• Add OIDC permissions to the CI workflow that runs AWS-backed tests.
• Replace inline AWS access key secrets on the QA step with aws-actions/configure-aws-credentials@v4 using secrets.AWS_OIDC_ROLE_ARN.
• Bump dcicutils to 8.18.5 and add a changelog entry.

Validation

• ruby -ryaml -e 'ARGV.each { |p| YAML.load_file(p); puts p }' .github/workflows/*.yml\n- git diff --check\n\n## Notes\n- CI will require the AWS_OIDC_ROLE_ARN GitHub secret and corresponding IAM role to be configured by the captain before AWS-backed tests can pass.

[coveralls]

Coverage Report for CI Build 28961780249

Coverage increased (+0.03%) to 75.398%

Details

• Coverage increased (+0.03%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 3 coverage regressions across 2 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

3 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
dcicutils/file_utils.py	2	40.21%
dcicutils/qa_utils.py	1	82.88%

---

Coverage Stats

Relevant Lines:	15214
Covered Lines:	11471
Line Coverage:	75.4%
Coverage Strength:	0.75 hits per line

---

💛 - Coveralls