#3732 fix(attestation): avoid logging the raw federated OIDC token

Summary

The GitHub OIDC runner used by the attestation crafter wrote the raw federated identity token to its debug logs while requesting and verifying it. With debug logging enabled, that short-lived identity token could end up in CI job logs.

This change removes the token value from those debug log lines so it is no longer written to the logs. The token is still used for the actual verification.

See also:

• Workflow commands — Masking a value in a log
• About security hardening with OpenID Connect

Masking is also exact-string match on GitHub-hosted runners, so it does not help self-hosted runners, other CI systems, or logs exported to external collectors.