patch: update to oidc token v2

[jenny-miggin]

Checklist

• All new jobs, commands, executors, parameters have descriptions
• Examples have been added for any significant new features
• README has been updated, if necessary

Motivation, issues

A new version of the OIDC token has been published, to allow for additional claims.

The new value is org/ORGANIZATION_ID/project/PROJECT_ID/user/USER_ID/vcs-origin/VCS_ORIGIN/vcs-ref/VCS_REF, a string, where ORGANIZATION_ID, PROJECT_ID, and USER_ID are UUIDs that identify the CircleCI organization, project, and user, respectively. The user is the CircleCI user that caused this job to run. VCS_ORIGIN and VCS_REF are strings that identify the repo URL and reference to the change that caused the job to run.

Description

Updated instances of $CIRCLE_OIDC_TOKEN to $CIRCLE_OIDC_TOKEN_V2, and also updated the orb tools orb version from 11.1 to 11.6

[brivu]

Looks good, thank you @jenny-miggin!

[davidbaskin33]

For what it's worth, this was a breaking change for us. We had our IAM permissions configured to specifically match on strings in the format org/ORGANIZATION_ID/project/PROJECT_ID/user/USER_ID. Since I don't see documentation on what to expect for the values of VCS_ORIGIN and VCS_REF, updating to org/ORGANIZATION_ID/project/PROJECT_ID/user/USER_ID/* fixed the issue for us.