Adds a new way to authenticate the action with Workload Identity. Instead of storing a Service Account token or Connect credentials, the action exchanges the GitHub Actions OIDC token for short-lived 1Password access.

To use it, set three environment variables on the step:

• OP_WORKLOAD_ID
• OP_ENVIRONMENT_ID
• OP_INTEGRATION_KEY

When all three are set, the action loads every variable from the configured 1Password environment. If none are set, it falls back to the existing Service Account / Connect flow.

Changes

• New auth path via the @1password/sdk package (src/sdk-client.ts).
• Validation for the new config: errors clearly if only some of the three vars are set, or if Workload Identity is mixed with another auth method.
• Unset env: a cleanup step (unset-previous) works without credentials, so Workload Identity users can remove secrets in a later step.
• Tests for the new config logic and SDK client.
• E2E job covering the Workload Identity flow.
• README section documenting the feature (marked private beta).

⚠️ This is a private beta release, hence why this PR targets a beta branch as it will be released from there.