Fix CI OIDC token caching

[zachajon-cisco]

Summary

Reuses the SDK's refreshable OIDC token source for the built-in GitHub Actions and Azure DevOps authentication providers. This caches an exchanged Databricks access token until it needs to be refreshed instead of requesting and exchanging a new CI OIDC token for every API request.

Why

The github-oidc and azure-devops-oidc providers currently create a new ClientCredentials token source each time credentials are read. Because that token source does not survive the call, its Databricks access-token cache is also discarded after every request.

Workloads that make several SDK calls consequently request a new CI OIDC token and perform another Databricks token exchange for every API request. In GitHub Actions, the OIDC request token can become unavailable later in the job, causing otherwise valid authenticated clients to fail with Cannot get GitHub OIDC token.

The SDK already has DatabricksOidcTokenSource, which caches access tokens and fetches a fresh external ID token when the cached token expires. This change routes both built-in CI providers through that existing implementation.

Addresses #1564.

What changed

Interface changes

• Adds an optional authorization_details argument to DatabricksOidcTokenSource so the cached path preserves the token-exchange parameters supported by the existing CI provider implementation.

Behavioral changes

• GitHub Actions and Azure DevOps OIDC authentication now reuse a valid Databricks access token across SDK requests.
• When that access token becomes stale or expires, the SDK obtains a fresh external ID token and performs a new exchange.
• Existing audience, scope, group-assumption, asynchronous-refresh, and authorization-details behavior is preserved.

Internal changes

• Adds an IdTokenSource adapter for the existing CI OIDC token-supplier interface.
• Routes the shared CI OIDC provider through oidc_credentials_provider and DatabricksOidcTokenSource.
• Adds regression coverage for both github-oidc and azure-devops-oidc, including repeated credential reads and preservation of authorization details.

How is this tested?

• .venv/bin/pytest tests/test_credentials_provider.py tests/test_oidc.py — 123 passed.
• .venv/bin/pytest -q -o log_cli=false -m 'not integration and not benchmark' tests — 2,171 passed, 3 skipped, 135 deselected.
• .venv/bin/ruff check databricks tests — passed.
• .venv/bin/ruff format --check databricks tests — all 157 files formatted.

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-py

Inputs:

• PR number: 1565
• Commit SHA: 02c61af9323b8a7471861e390e5dba9b41ca6deb

Checks will be approved automatically on success.