feat(static-site-deploy): deploy with the workflow's OIDC identity

Without BUNNY_STORAGE_PASSWORD, the action now requests the running
workflow's OIDC identity token (Forgejo with enable-openid-connect,
GitHub with id-token: write) for the gateway's audience and starts the
deployment with it. It takes the Storage Zone password from the
gateway's answer, masks it in the log, plans and uploads with it, and
finalizes or aborts with a fresh token. A dry run in this mode stays
local. Password deployments work as before.

action.yml finds its script under FORGEJO_ACTION_PATH or
GITHUB_ACTION_PATH, so the action also runs on GitHub Actions.

README.md

@@ -1,7 +1,7 @@
 # Static Site Deploy
 
-A small, dependency-free Forgejo Action that synchronizes a completed static
-website build to a dedicated Bunny Storage Zone.
+A small, dependency-free action for Forgejo Actions and GitHub Actions that
+synchronizes a completed static website build to a dedicated Bunny Storage Zone.
 
 The runner needs Bash and Python 3.11 or newer. The action itself installs no
 packages and executes no code from the Gandalf repository.
@@ -54,6 +54,54 @@ Interrupted uploads are aborted best-effort; abandoned leases expire after 30
 minutes. The dedicated Storage Zone password authorizes this workflow without
 exposing an account-wide API key to the project.
 
+## Deploying with the repository's identity
+
+With the Gandalf gateway, a site linked to its repository needs no secret at
+all. Leave `BUNNY_STORAGE_PASSWORD` unset and let the job request an OIDC
+identity token: the action presents it to the gateway, which checks the
+repository and branch and hands out the Storage Zone password for this one
+deployment. The action masks it in the log, and the gateway replaces it once the
+deployment is done (unless the site also allows password deployments).
+
+Forgejo:
+
+```yaml
+jobs:
+  deploy:
+    runs-on: docker
+    enable-openid-connect: true
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v6
+      - run: npm ci && npm run build
+      - uses: https://forge.tionis.dev/actions/static-site-deploy@<commit-sha>
+        with:
+          directory: dist
+          storage-zone: example-org
+          purge-endpoint: https://gandalf.tionis.dev
+```
+
+GitHub, using a GitHub mirror of this repository:
+
+```yaml
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci && npm run build
+      - uses: <owner>/static-site-deploy@<commit-sha>
+        with:
+          directory: dist
+          storage-zone: example-org
+          purge-endpoint: https://gandalf.tionis.dev
+```
+
+A dry run in this mode only checks the build locally; comparing with the
+deployed files needs the password.
+
 ## Edge rules
 
 Bunny Storage has no `_headers` or `_redirects` file and picks a file's