fix: prefer GitHub OIDC provider if enabled

[imjasonh]

We've had reports of unusual behavior in cosign and other tools that use this idiom, when it's used in a GitHub self-hosted runner with id-token: write and when the environment it's hosted in also provides ambient OIDC credentials (e.g., GKE).

The issue is that both GitHub's ID token is available, and the GKE environment's credentials are as well. The way this code worked before, and due to Go's map iteration randomization, this code would randomly choose between GitHub and Google credentials, producing ...confusing behavior.

This PR addresses this issue by iterating through providers in the order they were underscore-imported, rather than randomly as the map is iterated. This also changes pkg/providers/all* to explicitly order the imports so that github comes first, so those credentials are consistently used before any others.

*This is gross. pkg/providers/all is gross. It's a dependency bomb, and it should not exist. I'd like to refactor this in a future set of changes to deprecate all, and encourage consumers to explicitly import only the providers they want, then do something like sigstore/sigstore#1115 where these providers are split into separate Go modules, so consumers of cosign as a library don't have to import all these heavy dependencies. That's a battle for another day though.

Demo that explicit import order changes the order of init execution: https://go.dev/play/p/TFqq6BRmLDz

@haydentherapper

[codecov]

Codecov Report

Merging #3044 (4e3938b) into main (d0cc985) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #3044   +/-   ##
=======================================
  Coverage   31.08%   31.08%           
=======================================
  Files         155      155           
  Lines        9739     9739           
=======================================
  Hits         3027     3027           
  Misses       6250     6250           
  Partials      462      462           

[haydentherapper]

Nice fix!

In the meantime, we can also encourage using --oidc-provider if there are cases where someone wants to prefer a later-imported provider.

[hectorj2f]

lgtm