Add OIDC workflow for CEINTL localization feedback

[AlesProkop]

Related to #14246

Context

The expert-review workflow can identify translation defects in OneLoc pull requests, but filing the corresponding CEINTL feedback is manual. This adds fully automatic filing that uses GitHub OIDC and a dedicated Microsoft Entra identity instead of a PAT.

Changes Made

• Added .github/workflows/file-ceintl-localization-feedback.yml to scan open pull requests once daily and select unhandled OneLoc findings.
• Added validation for the dotnet-bot author, OneLoc title and branch, trusted repository, localization-only files, and findings from the MSBuild expert-review workflows.
• Added a hidden pull-request comment marker so scheduled scans process each finding once while CEINTL tag matching remains the authoritative deduplication check.
• Added OIDC authentication through the ceintl-ticketing environment without checking out or executing pull-request code.
• Added scripts/New-CeintlLocalizationFeedback.ps1 to load the CEINTL Feedback template, preserve writable template fields, deduplicate by an exact pull-request tag, create the work item, and return its URL.
• Added a pull-request comment linking the created or existing CEINTL item.
• Added manual dispatch for the first live test and recovery scenarios.
• Documented the automatic flow in documentation/wiki/Localization.md.

Testing

• Parsed scripts/New-CeintlLocalizationFeedback.ps1 with the PowerShell AST parser.
• Parsed the workflow with ConvertFrom-Yaml.
• Verified that PR Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 14614733 #14246 satisfies the discovery and validation rules.
• Exercised mocked CEINTL creation and exact-tag deduplication paths, including the Entra bearer-token header and workflow outputs.
• Exercised scheduled discovery against the current open dotnet-bot pull requests.
• No live CEINTL work item was created because the service identity and GitHub environment are not configured yet.

Notes

• Create a dedicated Microsoft Entra app/service principal with GitHub federation: issuer https://token.actions.githubusercontent.com, subject repo:dotnet/msbuild:environment:ceintl-ticketing, and audience api://AzureADTokenExchange.
• Add the service principal object to the ceapex Azure DevOps organization and CEINTL project, granting only the work-item/template read access and work-item creation access required by this workflow.
• Create the GitHub environment ceintl-ticketing without required reviewers. Restrict its deployment branches to the default branch so scheduled jobs can obtain OIDC tokens only from trusted workflow code.
• Configure environment variables CEINTL_CLIENT_ID, CEINTL_TENANT_ID, and CEINTL_TEAM. CEINTL_TEAM must identify the team that owns Feedback template 9a48bdd1-98da-4592-8d8d-c52c0856301d.
• Configure the identity and environment before merging. After merge, run the workflow manually against a known OneLoc finding to confirm the CEINTL template fields and permissions; subsequent findings require no human interaction.