Update to new specification implied by workload identity

[vishvananda]

This updates the factor "platform" and documentation in the following ways:

1. Instead of exposing __REF__*_TOKEN it exposes a json representation of credentials as a *_CREDS json blob that looks like the following:

{
  "type": "oidc",
  "data": {
    "token": "file://path/to/default.token"
  }
}

2. It allows for incoming identities to be specified in the environment as a *_CLIENT_CREDS json blob that looks like the following:

{
  "type": "oidc",
  "client_id": "default",
  "data": {
    "iss": "http://localhost:5000",
    "sub": "local",
    "aud": "default"
  }
}

3. It uses X-Client-Id instead of X-Factor-Client-Id for the header representing the client id
4. It allows for REJECT_UNKNOWN to be specified in the environment to control whether requests from unknown clients should be rejected with a 403 or passed through with no X-Client-Id header