chore(ci): enable OIDC login for NuGet publish

Adds OIDC-based NuGet login before publishing and conditionally uses the OIDC-provided API key for the official NuGet feed while falling back to existing secrets for other feeds.

- Adds an OIDC authentication step prior to package publish.
- Uses the OIDC token for api-key and symbol-api-key when targeting the official NuGet source.
- Retains secret-based keys for other package sources.
- Improves security by reducing reliance on long-lived secrets and enabling ephemeral credentials.

Author: SakuraIsayeki

.github/workflows/nuget-publish.yml

@@ -74,11 +74,19 @@ jobs:
           subject-path: "${{ env.YumeChan_PluginsLocation }}/**/*nupkg"
 
       # Publish
+            
+      - name: NuGet login (OIDC)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      
       - name: Publish packages to ${{ matrix.nuget.name }}
         run: |
           dotnet nuget push "${{ env.YumeChan_PluginsLocation }}/**/*.nupkg" \
           --source "${{ matrix.nuget.source }}" \
           --symbol-source "${{ matrix.nuget.source }}" \
-          --api-key "${{ secrets[matrix.nuget.keyname] }}" \
-          --symbol-api-key "${{ secrets[matrix.nuget.keyname] }}" \
+          --api-key "${{ matrix.nuget.name == 'NuGet' && steps.login.outputs.NUGET_API_KEY || secrets[matrix.nuget.keyname] }}" \
+          --symbol-api-key "${{ matrix.nuget.name == 'NuGet' && steps.login.outputs.NUGET_API_KEY || secrets[matrix.nuget.keyname] }}" \
           --skip-duplicate