Improve availability of oidc-federation-service

[Michael5601]

This draft PR improves the availability of the oidc-federation-service by changing the following:

1. Increase replicas from 1 to 5
2. Add a VPA to increase resource request on demand
3. Spread replicas across multiple zones

Active-Active is possible for the oidc-federation-service as the only limiting factor is the Github REST API rate limit, which is sufficient for 5 replicas. We call the API in token_exchange.py for the following:

1. JWKS keys — at most 5 fetches per 24h per issuer.
2. oidc-federation.yaml — at most 5×4 = 20 fetches/hour per org.
3. Installation IDs — 5 fetches total at pod startup, then cached forever.
4. Token request — this is one call per incoming request regardless of replica count, so replicas don't change anything here.

Release note:

NONE

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign zkdev for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[CLAassistant]

All committers have signed the CLA.

[TuanAnh17N]

good progress! :)