Update OIDC configuration to use immutable claims in GH actions

see https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims

Start by locating the GitHub Actions workflow configuration and compare its OIDC settings with the linked GitHub documentation on immutable subject claims. Update the relevant configuration so it uses immutable claims, then verify the workflows still validate and authenticate as expected.

由索引模型根据 Issue 内容生成。