sbom-upload: re-exchange GCS token before set-release-status

[ccwienk]

Problem

The GCS bearer token obtained at job start expires mid-run on long-running
jobs. The Set release status step uses ${{ inputs.gcs-token }} — the
token evaluated at job startup — and has no awareness of the mid-run refresh
that upload.py performs internally via System Trust. On jobs that run longer
than the token TTL (~25 min), the status write fails with HTTP 401
"Invalid Credentials".

Observed on kubernetes-dev/landscape-dev-garden whose sbom-upload job
takes ~1h47m (1549 uploads + scan-missing). Staging (~30 min) is unaffected.
Result: SBOMs upload successfully but neither promoted nor released status
is written to the Cumulus GCS bucket for that run-key.

Fix

Add a Refresh GCS token before status write step immediately before
Set release status, reusing the existing oidc-gcp-token-exchange action
with a distinct token-env-prefix (GCS_STATUS_). The Set release status
step then prefers the freshly-issued token and falls back to the initial token
when token-exchange inputs are not provided (static-token callers).

The refresh step is guarded by inputs.token-exchange-api-url != '' so it is
a no-op for callers that do not supply exchange parameters.

Test plan

• CI (non-release) green on feature branch
• Build OCM (Image w/ CLI) green on feature branch
• Verify on next ls-dev deploy-and-release run: set-release-status: HTTP 200

Release note:

sbom-upload: re-exchange GCS token immediately before set-release-status to
prevent HTTP 401 on long-running jobs where the initial token expires mid-run.

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tuananh17n for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment