ci: update identity-team workflows to v1.16.0 and ignore known vulnerabilities (#332)

## Description

This PR updates the reusable `canonical/identity-team` workflow
references to version
[`v1.16.0`](https://github.com/canonical/identity-team/releases/tag/v1.16.0)
(`e017941885bd1d17774bf7be2cbbb1d1abe80d9e`) and utilizes the new
`ignore-vulnerabilities` input in the `oci-publish` job of
`.github/workflows/ci.yaml`.

### Changes
- Updated `canonical/identity-team` workflow references in
`.github/workflows/ci.yaml` and `.github/workflows/cves.yaml` from
`v1.15.0` to `v1.16.0`.
- Configured `ignore-vulnerabilities` on the `_rock-oci-publish.yaml`
job with the list of ignored CVEs / vulnerabilities defined in
[`oci/hydra/image.yaml`](https://raw.githubusercontent.com/canonical/oci-factory/refs/heads/main/oci/hydra/image.yaml):
  - `CVE-2026-32286`
  - `CVE-2026-33818`
  - `CVE-2026-33997`
  - `CVE-2026-34040`
  - `CVE-2026-39821`
  - `CVE-2026-46600`
  - `CVE-2026-56853`
  - `CVE-2026-56858`
  - `CVE-2026-56859`
  - `CVE-2026-56860`
  - `CVE-2026-56862`
  - `GO-2026-5932`

### Related Work
- canonical/identity-team#142 ([Release
v1.16.0](https://github.com/canonical/identity-team/releases/tag/v1.16.0)):
Added support for `ignore-vulnerabilities` in `_rock-oci-publish.yaml`.
- canonical/oci-factory#1182: Upstream OCI Factory changes introducing
ignored vulnerabilities support.

Author: shipperizer

.github/workflows/ci.yaml

@@ -54,6 +54,19 @@ jobs:
       edge-release: false
       eol-stable-release: "3 month"
       ubuntu-base-version: "26.04"
+      ignore-vulnerabilities: >-
+        CVE-2026-32286,
+        CVE-2026-33818,
+        CVE-2026-33997,
+        CVE-2026-34040,
+        CVE-2026-39821,
+        CVE-2026-46600,
+        CVE-2026-56853,
+        CVE-2026-56858,
+        CVE-2026-56859,
+        CVE-2026-56860,
+        CVE-2026-56862,
+        GO-2026-5932
     secrets:
       PAT_TOKEN: ${{ secrets.PAT_TOKEN }}