Extending OIDC subject claims

(I'm only speaking about the GitHub OIDC provider, as I'm not familiar with the others)

Currently, the OIDC subject claim is dependent on the branch name.
https://github.com/aws/aws-sam-cli/blob/5e90c508d50fc57b786d1076bab351c3144ddd77/samcli/commands/pipeline/bootstrap/pipeline_oidc_provider.py#L88-L91

I'm trying to alter the workflow to run on `pull_request` events. However, the subject that GitHub uses is different for `pull_request` events: `repo:$org/$repo:pull_request`. So my workflow is being denied access, because the trust policy of the role does not match.

It is possible to customize the token claims on GitHub's side ([link](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-token-claims)). But I think it makes sense to extend upon the trust policy configuration, to support e.g. pull request events.

For posterity, these are the resulting subject claims used in `AssumeRoleWithWebIdentity`:

```
Pull request:
"subjectFromWebIdentityToken": "repo:$org/$repo:pull_request"

On push:
"subjectFromWebIdentityToken": "repo:$org/$repo:ref:refs/heads/$branch-name",
```