fix(arm): compare GCP WIF reuse account/issuer for exact equality

The provider-reuse check on setup-gcp-wif.sh ran a single describe with
--format='value(aws.accountId,oidc.issuerUri)' and tested the tab-joined
result with a suffix glob (OIDC) or prefix glob (AWS). Both are substring
tests standing in for equality: an existing OIDC provider whose issuer
merely ENDS with the expected one (e.g. an attacker-hosted
https://evil.example.com/<expected-issuer>, an ordinary HTTPS URL GCP
would fetch /.well-known/openid-configuration from) passed the check, as
did an AWS account ID merely STARTING with the expected one. That made
the attribute-condition and attribute-mapping checks below it vacuous,
since they only bind the identity this check was supposed to have
already pinned.

Split into two separate describe calls, one per field, each compared
with exact !=. Pre-existing in the reuse path added by #1651, not
introduced by this PR. This is the fifth substring-standing-in-for-
equality defect found in this codebase.

Author: cristim

arm/CUDly-CrossSubscription/setup-gcp-wif.sh

@@ -260,18 +260,32 @@ else
     --workload-identity-pool="$POOL_ID" \
     --format='value(attributeCondition)')
   # A provider of the other type would emit a credential config that does not
-  # match it and mint an attribute the grant below never names.
-  EXISTING_TYPE=$(gcloud iam workload-identity-pools providers describe "$PROVIDER_ID" \
-    --project="$PROJECT" --location=global \
-    --workload-identity-pool="$POOL_ID" \
-    --format='value(aws.accountId,oidc.issuerUri)')
-  if [[ "$PROVIDER_TYPE" == "aws" && "$EXISTING_TYPE" != "${AWS_ACCOUNT_ID}"* ]]; then
-    die "provider '${PROVIDER_ID}' already exists but is not an AWS provider for account ${AWS_ACCOUNT_ID} (describe reports: ${EXISTING_TYPE}). Delete it and re-run:
+  # match it and mint an attribute the grant below never names. Compared as an
+  # exact match on the single relevant field, not a prefix/suffix test against
+  # the account-id/issuer-uri pair gcloud tab-joins under `value(a,b)`: a
+  # suffix test here would accept any issuer URI merely ENDING in the expected
+  # one (e.g. an attacker-hosted https://evil.example.com/<expected-issuer>,
+  # whose /.well-known/openid-configuration GCP would then fetch from the
+  # attacker, who can mint a token with any subject), and a prefix test would
+  # accept any account ID merely STARTING with the expected one.
+  if [[ "$PROVIDER_TYPE" == "aws" ]]; then
+    EXISTING_ACCOUNT_ID=$(gcloud iam workload-identity-pools providers describe "$PROVIDER_ID" \
+      --project="$PROJECT" --location=global \
+      --workload-identity-pool="$POOL_ID" \
+      --format='value(aws.accountId)')
+    if [[ "$EXISTING_ACCOUNT_ID" != "$AWS_ACCOUNT_ID" ]]; then
+      die "provider '${PROVIDER_ID}' already exists but is not an AWS provider for account ${AWS_ACCOUNT_ID} (describe reports account: ${EXISTING_ACCOUNT_ID:-none}). Delete it and re-run:
 ${DELETE_HINT}"
-  fi
-  if [[ "$PROVIDER_TYPE" == "oidc" && "$EXISTING_TYPE" != *"${ISSUER_URI}" ]]; then
-    die "provider '${PROVIDER_ID}' already exists but is not an OIDC provider for issuer ${ISSUER_URI} (describe reports: ${EXISTING_TYPE}). Delete it and re-run:
+    fi
+  else
+    EXISTING_ISSUER=$(gcloud iam workload-identity-pools providers describe "$PROVIDER_ID" \
+      --project="$PROJECT" --location=global \
+      --workload-identity-pool="$POOL_ID" \
+      --format='value(oidc.issuerUri)')
+    if [[ "$EXISTING_ISSUER" != "$ISSUER_URI" ]]; then
+      die "provider '${PROVIDER_ID}' already exists but is not an OIDC provider for issuer ${ISSUER_URI} (describe reports issuer: ${EXISTING_ISSUER:-none}). Delete it and re-run:
 ${DELETE_HINT}"
+    fi
   fi
   if [[ "$EXISTING_CONDITION" != "$EXPECTED_CONDITION" ]]; then
     die "provider '${PROVIDER_ID}' already exists with a different attribute condition, so this script cannot vouch for which identities enter pool '${POOL_ID}'.