build/bake: support Docker Hub OIDC registry identities

[crazy-max]

follow-up docker/login-action#1054

This adds Docker Hub OIDC support to registry identities so build.yml, bake.yml, and verify.yml can authenticate to Docker Hub without passing a Docker Hub token through the reusable workflow boundary.

The registry identity setup workflow now accepts type: dockerhub with a username, connection ID, and optional registry value that defaults to Docker Hub. The build, bake, and verify workflows mint the Docker Hub token inside each job through docker/login-action and pass the resolved registry into the login step.

This keeps Docker Hub OIDC aligned with the existing registry identity model while avoiding token plumbing between jobs. The registry remains configurable instead of being hardcoded, and callers can keep using registry-auths for static credentials alongside keyless registry identities.

[vvoland]

My AI frend flagged this:

The pinned docker/login-action requests a 300-second Docker Hub OIDC token unless DOCKERHUB_OIDC_EXPIREIN is set.

This login runs before the full build-and-push step. Docker stores that token as the registry password, so a build lasting more than five minutes can fail when BuildKit requests authorization during the push.

Set DOCKERHUB_OIDC_EXPIREIN: 3600 in the Docker Hub login steps, including the equivalent bake.yml block, or otherwise refresh credentials before registry operations.
The verify and finalize jobs should use the longer lifetime too if they can process many images.

[crazy-max]

He's wrong, the expire-in doesn't apply to the auth to the registry but the mint token used before authenticating.

[vvoland]

Ah, I see!