`runner` OIDC credential management

- [ ] Document warning about using "short-term" credentials
- [ ] Document/Show possible ways to extend credential life?
- [ ] Document/provide examples for "refreshing" credentials used by the `cml runner` created instance.

Why? By default, these OIDC credentials expire after `1hr` which is likely to be surpassed by ML workflows. After which time cml will fail to self-delete.

----
### Other notes:
on `AWS` code wise the credential format is the exact same and essentially no changes are required
on `GCP` credentials format was different requiring custom parsing to determine the `ProjectID` see: https://github.com/iterative/terraform-provider-iterative/pull/506
on `az`/`azure` 🙈 I have done zero testing

**/CC** https://github.com/iterative/cml.dev/pull/208
Follow up of iterative/cml#862