Support self lookup in trust policy

[stevehipwell]

I'd like to be able to reference the current repo in a trust policy without needing to hardcode the values. Something like the following could work and align with GitHub Actions.

issuer: https://token.actions.githubusercontent.com
subject: repo:${{ github.repository }}:pull_request
base_ref: refs/heads/main
actor: dependabot[bot]

permissions:
  contents: write

It'd only make sense to implement a small subset of the github context for static values but this would make it easier to use octo-sts across multiple repos.

• github.repository
• github.repository_owner