fix: update OIDC FIC subjects to match org-level custom claim template; bump action versions

[Copilot]

Nightly Build & Deploy fails at Azure OIDC login — the Microsoft GitHub org now uses a customised OIDC subject claim template (repository_owner_id:ID:repository_id:ID:...) but the Bicep FICs were still configured with the old repo:org/repo:... format.

OIDC FIC subject format

• Replace githubOrg/githubRepo string params with githubOwnerId/githubRepoId numeric ID params across managed-identity.bicep and main.bicep
• FIC subjects now use repository_owner_id:${githubOwnerId}:repository_id:${githubRepoId}:environment:${env} (and :ref:refs/heads/main for the staging main-branch FIC)
• nightly.yml deploy step passes ${{ github.repository_owner_id }} and ${{ github.repository_id }}

subject: 'repository_owner_id:${githubOwnerId}:repository_id:${githubRepoId}:environment:${environmentName}'

Action version bumps (Node.js 20 deprecation)

• actions/checkout v4 → v5
• actions/setup-node v4 → v5
• azure/login v2 → v3

Applied across ci.yml, deploy.yml, and nightly.yml.

⚠️ Bootstrap note

First run post-merge will still fail at build-and-push because the Azure FIC update happens in the downstream deploy job. One-time manual FIC update required:

az identity federated-credential update \
  --name "github-actions-env-nightly" \
  --identity-name "id-acroyoga-nightly" \
  --resource-group "rg-acroyoga-nightly" \
  --subject "repository_owner_id:6154722:repository_id:1182392763:environment:nightly"

Subsequent Bicep deployments will self-maintain the correct format.