feat: improve alibaba cloud credential providers in OSS artifacts

[DahuK]

Motivation

Improve the credential security of OSS artifacts, avoid hardcoding AK in secret
For more details abount alibaba cloud credential provider, please refer to credentails-go

Modifications

add new configuration for OSSBucket in workflow_types.go to support using the default provider chain or the oidc token provider to get alibaba cloud credentials.

	// RoleARN is the Alibaba Cloud Resource Name(ARN) of the role to assume.
	RoleARN string `json:"roleARN,omitempty" protobuf:"bytes,8,opt,name=roleARN"`

	// OidcProviderARN is the Alibaba Cloud Resource Name (ARN) of the OIDC IdP.
	OidcProviderARN string `json:"OidcProviderARN,omitempty" protobuf:"bytes,9,opt,name=OidcProviderARN"`

	// OidcTokenFile is the file path of the OIDC token.
	OidcTokenFile string `json:"OidcTokenFile,omitempty" protobuf:"bytes,10,opt,name=OidcTokenFile"`

	// UseSDKCreds tells the driver to figure out credentials based on sdk defaults.
	UseSDKCreds bool `json:"useSDKCreds,omitempty" protobuf:"varint,11,opt,name=useSDKCreds"`

and refine the artifacts oss.go to init the OSS client with then given provider configuration

Verification

• Run make pre-commit -B
• Run draft PR to check changes

[terrytangyuan]

Have you tested this change in an actual OSS bucket?

[terrytangyuan]

Be more descriptive or remove the comment

[DahuK]

fixed

[terrytangyuan]

Please also resolve conflicts

[DahuK]

Have you tested this change in an actual OSS bucket?

@terrytangyuan Thanks for your review! I have tested both of RRSA service account mode and the original AK/SK mode in ACK cluster, it works fine when saving and loading OSS artifacts in output/input wf steps.

[DahuK]

Please also resolve conflicts

Fixed, thanks！and added some instructions on how to cofigure and use Alibaba Cloud OSS RRSA in configure-artifact-repository.md

[terrytangyuan]

Thank you!