Exchange OIDC token for API key

Exchange an OIDC identity token from a trusted publisher for a short-lived RubyGems API key. This enables automated gem publishing from CI/CD systems without storing long-lived API keys.