feat(workload-identity): Workload Identity Federation (WIP — Heimdal hackathon)

[jeschkies]

Summary:

• Refactors configuration of request headers. Uses Option.Apply() pattern now.
• Introduces Workload Identify Federation by leveraging AWS STS GetWebIdentityToken().

[github-actions]

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/go.yml:5:3
   |
 5 | /   build:
 6 | |     runs-on: ubuntu-latest
 7 | |
 8 | |     steps:
...  |
23 | |         run: go test ./...
24 | |
   | | ^
   | | |
   | |_this job
   |   default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions