use oidc with sync action

[tomjemmett]

switches from using sas tokens to OIDC.

this has the benefit that we use a managed identity in azure with specifically scoped access to the data, and through OIDC we get a fresh token as needed.

there were some aditional setup steps, detailed below:

1. create a new managed identity in the same azure resource group as our storage account
2. grant this managed identity storage blob data contributor to the container we use for the inputs app. do not grant it access to any more containers in the account.
3. set up federated credentials in the managed identity. set this to github, to this org/repo, and the production environment
4. in this repos settings, in the production environment, create 3 new secrets: AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, AZURE_CLIENT_ID. The client id is found on the managed identity created in step 1.

We have manaually tested that his action works using the workflow dispatch.

[Copilot]

Pull request overview

Updates the sync-data GitHub Actions workflow to authenticate to Azure Blob Storage using OIDC + a managed identity instead of SAS tokens, reducing long-lived credentials and enabling scoped access via Azure RBAC.

Changes:

• Adds azure/login@v3 and enables OIDC (permissions: id-token: write) for Azure authentication.
• Removes SAS-token based azcopy URLs and switches azcopy to use Azure CLI auth (AZCOPY_AUTO_LOGIN_TYPE=AZCLI).
• Pins the job to the production GitHub environment to match the federated credential configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[matt-dray]

Cheers, you demoed this for @StatsRhian and me yesterday along with #624. You and I also walked through it last week.