ci: switch gateway deploy to oidc

[Pigbibi]

Summary

• switch the gateway deploy workflow from GCP_SA_KEY to GitHub OIDC + Workload Identity Federation
• allow SSH/TWS/TOTP/VNC credentials to come from Secret Manager via repo vars, while keeping GitHub secret fallback
• document the new auth and secret configuration in README

Test Plan

• bash tests/test_workflow_shared_config.sh
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/main.yml")'\n- git diff --check