ci: publish VS Marketplace with Entra ID

[corwinm]

Summary

• switch VS Marketplace release publishing from VSCE_PAT to vsce publish --azure-credential
• add GitHub Actions OIDC permission and Azure login for the release workflow
• document required Azure/OIDC secrets and Marketplace publisher role setup

Validation

• pnpm install --frozen-lockfile
• pnpm run check-types
• pnpm run lint
• pnpm run package
• pnpm exec vsce package --no-dependencies --out /tmp/oil-code-secure-publish-test.vsix
• pnpm test

Notes

• Open VSX publishing still uses OPEN_VSX_TOKEN.
• The GitHub repository will need AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID secrets for the federated Azure identity before the first non-dry-run release.