Vault OIDC authentication

The Vault secret provider now supports OIDC login. If no token or environment credentials are set, Dagger opens your browser for OIDC authentication and caches the token with automatic expiry — no manual token management needed.