Configure custom issuer for GitHub Actions OIDC.

[sengi]

This straightforward change would help to mitigate accidental misconfiguration, without any significant downside (not likely to increase complexity, brittleness, maintenance burden or introduce any UX issues).

https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise

https://awsteele.com/blog/2023/01/11/improve-github-actions-oidc-security-posture-with-custom-issuer.html

Kudos to @christophetd and @aidansteele for putting us onto this.