fix(amplify-category-auth): clean up OIDC provider on auth stack teardown

[ahmedhamouda78]

Description of changes

The auth category's OpenId custom resource Lambda (openIdLambda.js) only handled Create/Update events. On stack deletion CloudFormation sends a Delete event, which fell through to a no-op — so the account-global IAM OIDC provider (accounts.google.com) was never removed. Orphaned providers accumulate in the account on every teardown of an auth resource configured with Google/OpenID federation.

This PR:

• Adds a Delete handler to openIdLambda.js. Because the provider is account-global and keyed by URL (the create path reuses it and appends client IDs), the handler removes only the client IDs this resource registered and deletes the provider only once no client IDs remain — preserving providers shared by other Amplify apps in the same account. All IAM calls tolerate an already-removed provider/client ID, so the handler is idempotent.
• Grants the OpenId Lambda role iam:RemoveClientIDFromOpenIDConnectProvider and iam:DeleteOpenIDConnectProvider (scoped to the accounts.google.com provider ARN) in auth-cognito-stack-builder.ts.
• Adds unit tests for create, sole-owner delete, shared-provider delete, and idempotent delete.

Issue #, if available

N/A

Description of how you validated changes

• New Jest unit test openIdLambda.test.js passes (4/4), driving the real handler through: create, sole-owner delete (provider removed), shared-provider delete (provider retained, only this resource's client IDs removed), and delete-when-absent (idempotent).
• Confirmed the IAM policy change does not alter existing stack-builder snapshots.

Checklist

• PR description included
• Tests are changed or added
• New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[ahmedhamouda78]

Thanks for the thorough review @soberm — all six points addressed in b16780b:

• [major] Concurrent-deletion race: After removing our client IDs I now re-read the provider and delete it if the list is empty, so two stacks racing on a shared provider can't leave it orphaned with zero client IDs. The existing NoSuchEntityException catch handles the case where the other deleter wins the final delete. Added a deletes the provider when a concurrent stack empties it during our Delete test that simulates the interleaving.
• [minor] Fragile URL matching: findProviderArn now derives the host via new URL(url).host and matches the provider ARN suffix. One correction to the suggested snippet: real OIDC provider ARNs use :oidc-provider/<host> (colon), e.g. arn:aws:iam::<account>:oidc-provider/accounts.google.com, so I matched on :oidc-provider/${providerHost} rather than /oidc-provider/... — the latter never matches.
• [minor] ListOpenIDConnectProviders: It's granted in the adjacent statement (account-level, Resource: *) since it can't be scoped to a single provider ARN. Added a comment there noting it's required by findProviderArn.
• [minor] invoke() guard: Now throws handler never called response.send instead of returning undefined.
• [nit] URL shadowing: Renamed the test constant to GOOGLE_OIDC_URL.
• [nit] Update coverage: Added a test that creates, then updates with an additional client ID and asserts it's appended.

All six unit tests pass locally under CI-like conditions (runtime-only deps mocked virtually).