chore(ci): update semantic release workflow to use OIDC

[brian-smith-tcril]

Following the pattern from openedx/paragon#4052

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.22%. Comparing base (59ac43b) to head (b4b2b93).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #660   +/-   ##
=======================================
  Coverage   72.22%   72.22%           
=======================================
  Files          56       56           
  Lines         504      504           
  Branches      108      108           
=======================================
  Hits          364      364           
  Misses        137      137           
  Partials        3        3           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[feanil]

Does this mean we also don't need to use the SEMANTIC_RELASE_GITHUB user token?

[brian-smith-tcril]

Based on the example in the semantic-release docs I think we should be able to just use secrets.GITHUB_TOKEN instead, but I'd like to update everything to use OIDC first, then go through and remove the semantic release token from all workflows/the org.