Learn how OIDC workload federation replaces static cloud keys with short-lived tokens, then build a Python federation gateway that validates issuer, audience, subject, and JWKS.