fix(signing): make KMS OIDC fallback test environment-independent

[infernus01]

Changes

Fix TestOIDCTokenFallbackToDefaultPath failing in the release pipeline while passing locally.

Problem

The test verifies that when oidc.path and oidc.role are configured
but no explicit tokenPath is given, NewSigner falls back to the
default Kubernetes service account token path
(/var/run/secrets/kubernetes.io/serviceaccount/token) and errors
because the file doesn't exist.

On developer machines this works, but in the release pipeline the tests
run inside a Kubernetes pod where that file does exist (auto-mounted
by K8s). So os.ReadFile succeeds, the OIDC block completes, and the
error surfaces later from kms.Get() with an empty KMSRef:

  no kms provider found for key reference: : parsing input key resource id:
  expected format: [plugin name]://[key ref], got:

This doesn't match the test's assert.Contains checks for
"reading OIDC token", causing the failure.

Fix

• Change defaultOIDCTokenPath from const to var (unexported, no
  API impact) so tests can override it.
• In the test, override it to t.TempDir() + "/nonexistent-sa-token" —
  a path guaranteed not to exist in any environment — and restore the
  original via t.Cleanup.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

/kind bug

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/lgtm

[jkhelil]

/cherry-pick release-v0.28.x

[tekton-robot]

✅ Cherry-pick to release-v0.28.x successful!

A new pull request has been created to cherry-pick this change to release-v0.28.x.

PR: #1767

Please review and merge the cherry-pick PR.