[OIDC 4] Add method to create a short-lived API key (minimal)

[joelverhagen]

Progress on #10212.
Depends on #10262.

This adds a new method to CredentialBuilder which creates a short-lived API key given a federated credential trust policy.

This method has a TODO in it linking to the OIDC work item because the exact shape of the short lived API key is still in discussion. The created credential is not yet associated with a user (the created by user account) because this is the responsibility of IAuthenticationService.AddCredential:

NuGetGallery/src/NuGetGallery.Services/Authentication/AuthenticationService.cs

Lines 629 to 641 in 0ec9961

	public virtual async Task AddCredential(User user, Credential credential)
	{
	if (user is Organization)
	{
	throw new InvalidOperationException(ServicesStrings.OrganizationsCannotCreateCredentials);
	}
	user.Credentials.Add(credential);
	await Entities.SaveChangesAsync();
	await Auditing.SaveAuditRecordAsync(new UserAuditRecord(user, AuditedUserAction.AddCredential, credential));
	_telemetryService.TrackNewCredentialCreated(user, credential);
	}

This will be called in a future PR while executing the token trade endpoint.

This stub allows me to perform the token trade flow with a current V4 API key, without any of the improvements we will need (such as hiding this API keys from the API key page, not sending API key expiration messages, etc.).