oidc: align token exchange with the Marketplace contract

[Benjamin Christopher Simmonds (benibenj)]

Summary

• Use the FederatedToken authorization scheme for Marketplace token exchange and specify api-version=7.2-preview.1.
• Preserve GitHub Bearer authentication, the marketplace.visualstudio.com audience, and existing VSCE_MARKETPLACE_URL configuration for exchange and upload.
• Test production and generic custom hosts, including trailing slashes, and document the exchange contract and session-token lifetime.

Validation

• npm run compile
• npm test -- --grep "OIDC trusted publishing" (8 passing)
• No-network smoke test confirming shared custom-host routing for exchange and the Gallery API.

Live end-to-end publishing has not been tested. The response parser continues to expect a credential field.