feat(dockerhub): use OIDC to publish to docker hub when available

[JonZeolla]

Summary

• replace separate Docker Hub questions with one subscription choice
• disable Docker Hub publishing for none
• use username/PAT authentication for personal
• use short-lived OIDC authentication for team and business
• generate documentation and setup guidance only for the selected path

Testing

• uv run pytest tests/test_cookiecutter.py::test_dockerhub_subscription_prompt tests/test_cookiecutter.py::test_dockerhub_release_authentication --no-cov
• full pre-commit suite passed during commit

Based on docker/login-action#1048 and Docker OIDC subscription requirements.

PR Description from Zenable

Replace the binary Docker Hub yes/no question with a single dockerhub_subscription choice (none, personal, team, business) that determines the authentication strategy.

• none: disables Docker Hub publishing entirely
• personal: uses username/PAT authentication
• team / business: uses short-lived OIDC authentication
• Generated documentation, workflow, README, and Taskfile are conditionally rendered based on the selected subscription tier

Testing

• uv run pytest tests/test_cookiecutter.py::test_dockerhub_subscription_prompt tests/test_cookiecutter.py::test_dockerhub_release_authentication --no-cov
• Full pre-commit suite passed during commit

Based on docker/login-action#1048 and Docker OIDC subscription requirements.

[ai-coding-guardrails]

Nice work! 😎

I didn't find anything of concern

Risk: 🟢 Low

Risk analysis

The highest scores are for test_coverage and security_impact. Test coverage is strong with new parametrized tests validating each subscription path, though the OIDC flow isn't fully exercised. Security impact is moderate due to the introduction of new authentication methods (OIDC and PAT-based) which, while following best practices, increase the surface area for credential handling and misconfiguration. The change affects generated project templates rather than runtime code, limiting blast radius and operational risk.

Reviewed with 🤟 by Zenable