[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT - #97603

CI authenticated to Vercel Remote Cache with a long-lived Personal Access
Token in the `TURBO_TOKEN` repository secret, wired into six workflows and
passed separately into `.github/actions/sccache` as a `turbo-token` input.
That token never expires, is scoped to a team member rather than the team,
and is readable by every job that inherits secrets. Each job now mints its
own short-lived, cache-only token instead, using
`vercel/setup-turborepo-remote-cache-action` against a Turborepo CLI OIDC
policy configured on the Vercel team.

The exchange step runs in `build_reusable.yml` and in the jobs that invoke
`turbo` or `sccache` directly, and writes `TURBO_TOKEN` and `TURBO_TEAM` for
the steps that follow. It is gated on the `TURBO_TEAM` repository variable,
which serves as both the team slug and the switch. Fork pull requests are not
given repository variables, so they skip the step instead of failing on an
OIDC token they cannot mint, and clearing the variable disables remote caching
through a longer Vercel outage without touching the workflows. The slug also
now lives in that one place rather than repeated across five workflows and the
`sccache` action. The workflow-level `env: TURBO_TOKEN` entries are deleted
rather than left in place, since precedence between an `env:` key and a
`$GITHUB_ENV` write is not documented by GitHub.

A failed exchange costs the job its remote cache rather than failing the job,
so the step carries `continue-on-error: true` and every copy of it uses the
same name.

Dropping those `env:` entries means `TURBO_TOKEN` can now be genuinely unset
rather than set-but-empty, which `.github/actions/sccache/start.sh` was not
written for: `${TURBO_TOKEN:0:3}` in its diagnostics is a substring expansion,
and `set -u` rejects those for an unset name even though it tolerates an empty
one. The script now binds `TURBO_TOKEN` and `TURBO_TEAM` to empty defaults up
front, so a skipped or failed exchange leaves sccache on disk-only caching
instead of aborting the step.

Because a called workflow can only downgrade the permissions it is handed,
`id-token: write` is granted on each job that calls `build_reusable.yml`
rather than inside it, matching how `test-new-tests-deploy` already mints an
OIDC token from within that workflow. For the integration test suites the
grant is declared at both hops of the chain. A blanket workflow-level grant
would have been shorter but would silently downgrade `validate-docs-links`,
which comments on pull requests and creates checks, and
`pr_stack_optimizer.yml`, which declares no permissions at all.

Every `secrets.TURBO_TOKEN` reference is gone, along with the now-dead
`turbo-token` input on the `sccache` action and the team slug it hardcoded as
a fallback. `test_e2e_project_reset_cron.yml` never invoked `turbo`, so its
`TURBO_TEAM`, `TURBO_CACHE` and `TURBO_TOKEN` entries are dropped rather than
migrated. `turbo.json` needs no change: no task hashes a `TURBO_*` variable,
so a token that rotates every run does not invalidate the cache.

(cherry picked from commit 1cdbd64)