Support enterprise GitHub Actions OIDC issuers

[bmendonca3]

Summary

• validate GitHub Actions OIDC token issuers against the expected provider host while allowing one enterprise slug path segment
• build the OIDC verifier from the validated token issuer so enterprise-scoped discovery endpoints are used
• add coverage for enterprise issuers and rejected spoofing/URL-component cases

Fixes #4501

Tests

• PATH=/tmp/go1.23.1/bin:$PATH go test ./github -count=1
• PATH=/tmp/go1.23.1/bin:$PATH go test ./... -count=1