migrate all workflows to OIDC auth

[kellygavin96]

Replaces static AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY GitHub secrets
with OIDC role assumption across all three workflows. This is more secure
as it eliminates long-lived AWS credentials stored as GitHub secrets.

Changes

• main-CI.yml — switched to OIDC auth
• main-deploy-dev.yml — switched to OIDC auth
• main-deploy.yml — switched to OIDC auth
• All three: bumped configure-aws-credentials v1 → v4 (required for OIDC)
• All three: added permissions: id-token: write block (required for GitHub to issue OIDC token)

Testing

• ✅ CI passed on this branch (minus a pre-existing Elasticsearch ConnectTimeout
  unrelated to this change)
• ✅ AWS credentials step passes with OIDC role assumption confirmed
• ✅ deploy-dev run manually from this branch

After this is merged

The following repo secrets can be deleted by an admin if this key is not used anywhere else within the repository:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY

AWS_OIDC_ROLE_ARN must remain.

NOTES

The Elasticsearch ConnectTimeout seen in CI is a pre-existing issue unrelated
to this change. Ran into AccessDenied issues which I fixed via the IAM Role Permissions but this ConnectTimeout should be unrelated and investigated separately.