Shrink package sizes

Thank you 🙇‍♀ for wanting to create an issue in this repository. Before you do, please ensure you are filing the issue in the right place. Issues should only be opened on if the issue relates to code in this repository.

• If you have found a security issue please submit it here
• If you have questions about writing workflows or action files, then please visit the GitHub Community Forum's Actions Board
• If you are having an issue or question about GitHub Actions then please contact customer support

If your issue is relevant to this repository, please include the information below:

Describe the enhancement
When pulling in @actions/glob (an 89KB package), it pulls in @actions/core (91KB package), fair enough. But... @actions/core depends on @actions/http-client, which has a 1.4MB install size due to pulling in Undici—which is already bundled in Node (but not all of it's exposed, so you do need the duplicate)!
I think it'd be reasonable to move getIDToken() to an @actions/oidc package to cut down on the size by 1.4MB, a >13x improvement (and switching to picomatch would also shave another 155B (~3x difference in size between the two), though it be might be too breaking?).
In comparison, tinyglobby (and all dependencies) is only 155KB, ~11x smaller than @actions/glob (and dependencies).

To both improve startup speed and the actions development experience, I'd say it'd make sense to shuffle some of this around.

Code Snippet
n/a

Additional information
Related: #1770 should allow tree shaking away these dependencies, although plenty of packages directly include node_modules (no build step) and the development install would still be large.
Node.js might expose ProxyAgent soon, allowing droppage of undici, once actions is bumped to 24 or whenever: nodejs/node#43187.
Codecov PR: codecov/codecov-action#1524 (I used tinyglobby instead, but they ended up switching to bash)

Start by tracing the dependency paths from @actions/glob through @actions/core and @actions/http-client, focusing on the getIDToken() entry point. Read related issue #1770 and compare the package-size concerns described here. Done means a reviewed dependency-splitting approach with its compatibility and size impact established.