fix(plugin-npm-cli): enable OIDC publish on CircleCI (#7122)

## What's the problem this PR addresses?

`yarn npm publish` skips the OIDC code path on CircleCI, even though
[#7075](#7075) was supposed to add
CircleCI support. That PR updated `getOidcToken()` in
`packages/plugin-npm/sources/npmHttpUtils.ts` to read `NPM_ID_TOKEN`
when `process.env.CIRCLECI` is set, but the gating expression in
`packages/plugin-npm-cli/sources/commands/npm/publish.ts` that decides
whether to pass `allowOidc: true` to `npmHttpUtils.put` was not updated:

```ts
allowOidc: Boolean(process.env.CI && (process.env.GITHUB_ACTIONS || process.env.GITLAB_CI)),
```

So on CircleCI, `allowOidc` is always `false`, `getOidcToken()` is never
called, and the publish either fails (no other auth) or falls back to a
long-lived token. This contradicts the stated intent of #7075 ("CircleCI
was recently added as a supported npm trusted publisher provider, but
Yarn's OIDC implementation only supports GitHub Actions and GitLab CI").

Reproduction: a CircleCI release pipeline that mints an OIDC token via
`circleci run oidc get --claims '{"aud":"npm:registry.npmjs.org"}'`,
exports it as `NPM_ID_TOKEN`, then runs `yarn npm publish` against a
package configured for trusted publishing. Expected: yarn exchanges the
id-token for a single-use publish token. Actual: yarn never attempts the
exchange, because the `allowOidc` gate excludes CircleCI.

Refs #7074, #7075.

## How did you fix it?

Added `process.env.CIRCLECI` to the disjunction, mirroring the branch
that #7075 already added in `getOidcToken()`:

```ts
allowOidc: Boolean(process.env.CI && (process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.CIRCLECI)),
```

This keeps the gate consistent with the providers `getOidcToken()`
actually handles, and matches the same one-line shape as the GitLab fix
in [#6938](#6938).

No new tests: the change is an additional disjunct in a Boolean gate;
there were no tests covering the GitHub Actions or GitLab CI cases of
this expression either, and #7075 / #6938 were merged without tests for
the same reason.

## Checklist

- [x] I have read the [Contributing
Guide](https://yarnpkg.com/advanced/contributing).
- [x] I have set the packages that need to be released for my changes to
be effective.
- [x] I will check that all automated PR checks pass before the PR gets
reviewed.

Author: joshuayoes

.yarn/versions/59c10b8d.yml

@@ -0,0 +1,36 @@
+releases:
+  "@yarnpkg/cli": patch
+  "@yarnpkg/plugin-npm-cli": patch
+
+declined:
+  - "@yarnpkg/core"
+  - "@yarnpkg/plugin-catalog"
+  - "@yarnpkg/plugin-compat"
+  - "@yarnpkg/plugin-constraints"
+  - "@yarnpkg/plugin-dlx"
+  - "@yarnpkg/plugin-essentials"
+  - "@yarnpkg/plugin-exec"
+  - "@yarnpkg/plugin-file"
+  - "@yarnpkg/plugin-git"
+  - "@yarnpkg/plugin-github"
+  - "@yarnpkg/plugin-http"
+  - "@yarnpkg/plugin-init"
+  - "@yarnpkg/plugin-interactive-tools"
+  - "@yarnpkg/plugin-jsr"
+  - "@yarnpkg/plugin-link"
+  - "@yarnpkg/plugin-nm"
+  - "@yarnpkg/plugin-npm"
+  - "@yarnpkg/plugin-pack"
+  - "@yarnpkg/plugin-patch"
+  - "@yarnpkg/plugin-pnp"
+  - "@yarnpkg/plugin-pnpm"
+  - "@yarnpkg/plugin-stage"
+  - "@yarnpkg/plugin-typescript"
+  - "@yarnpkg/plugin-version"
+  - "@yarnpkg/plugin-workspace-tools"
+  - "@yarnpkg/builder"
+  - "@yarnpkg/doctor"
+  - "@yarnpkg/extensions"
+  - "@yarnpkg/nm"
+  - "@yarnpkg/pnpify"
+  - "@yarnpkg/sdks"

packages/plugin-npm-cli/sources/commands/npm/publish.ts

@@ -168,7 +168,7 @@ export default class NpmPublishCommand extends BaseCommand {
             ident,
             otp: this.otp,
             jsonResponse: true,
-            allowOidc: Boolean(process.env.CI && (process.env.GITHUB_ACTIONS || process.env.GITLAB_CI)),
+            allowOidc: Boolean(process.env.CI && (process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.CIRCLECI)),
           });
         }