DCJ-755: Use workload identity to auth as staging test runner SA for staging smoke tests

[snf2ye]

Jira ticket: https://broadworkbench.atlassian.net/browse/DCJ-755

Addresses

Yale manages the key for the test runner service account. This does not automatically sync with the terraform that manages the secrets for github actions.

Switching to workload identity fixes this problem: Yale can manage the key and key rotation and it will sync with workload identity.

Summary of changes

• Following these instructions
• Update staging smoke tests to use workload identity instead of github secret

Related Changes

• https://github.com/broadinstitute/terraform-ap-deployments/pull/1737/files
• TODO: Follow-on terraform change to remove the SA from terraform
• TODO: Remove secret from github

Testing Strategy

• Run action from branch once terraform change is applied

Cherry pick action

Successful test run: https://github.com/DataBiosphere/jade-data-repo/actions/runs/11441504960/job/31829699245

[fboulnois]

Minor early suggestion:

[fboulnois]

You can put these permissions at the job level:

jobs:
  test-runner-staging:
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
27.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud