job_workflow_ref is insufficient to disambiguate actions workflows

[mattmoor]

Description

Github launched the ability to call other workflows like a step: https://github.blog/2021-11-29-github-actions-reusable-workflows-is-generally-available/ In these cases the launched job shows up as the job_workflow_ref, and NOT the workflow definition that lives in the user's repository.

Prior to this feature, the job_workflow_ref effectively codified the repo, workflow, and ref attributes into a single string, but with this feature all of that context is now lost!

I believe that the job_workflow_ref is still the correct identity for us to encode (it is what's doing the work), but we should also include (the no longer redundant) metadata about the originating workflow.

We already have a handful of Github extensions here:

fulcio/pkg/challenges/challenges.go

Lines 254 to 270 in f4746cc

	func workflowInfoFromIDToken(token *oidc.IDToken) (map[AdditionalInfo]string, error) {
	// Extract custom claims
	var claims struct {
	Sha string `json:"sha"`
	Trigger string `json:"event_name"`
	// The other fields that are present here seem to depend on the type
	// of workflow trigger that initiated the action.
	}
	if err := token.Claims(&claims); err != nil {
	return nil, err
	}
	// We use this in URIs, so it has to be a URI.
	return map[AdditionalInfo]string{
	GithubWorkflowSha: claims.Sha,
	GithubWorkflowTrigger: claims.Trigger}, nil
	}

I'd propose we also add: repo, workflow, and ref to enable folks to disambiguate callers.