Add CI OIDC auth for npm firewall

[tolgaergin]

Summary

• add lazy CI OIDC exchange for npm firewall checks when active and no bearer is already available
• keep LPM_TOKEN/stored auth as the preferred path so tokened CI does not do an OIDC exchange
• cover direct and chunked firewall preflight paths plus registry bearer detection

Verification

• cargo fmt
• cargo test -p lpm-cli --bin lpm-rs -- firewall_preflight
• cargo test -p lpm-registry --lib has_bearer_for_posture
• cargo test -p lpm-cli --bin lpm-rs -- registry_
• cargo test -p lpm-cli --bin lpm-rs -- firewall_policy_editor
• cargo build --workspace --locked
• cargo nextest run --locked --workspace --exclude lpm-workflows --exclude lpm-cli --no-fail-fast --status-level slow --final-status-level fail
• cargo test --locked -p lpm-cli --bin lpm-rs -- --test-threads=1
• cargo nextest run --locked -p lpm-cli -E "not binary_id(/bin\/lpm-rs/)" --no-fail-fast --status-level slow --final-status-level fail
• cargo build --release --locked