fix: immutable subject claim

[richeney]

Overview/Summary

Updated federated credential subjects for immutable organization and repo references, meeting the requirement for the GitHub platform change in https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens

This PR fixes/adds/changes/removes

1. Fixes [Bug]: Immutable subject claims Azure-Landing-Zones#4223

Breaking Changes

1. Assumes that ALZ Accelerator is creating a new repo and therefore immutable subject claim is required.

Testing Evidence

• Full test run iof ALZ Accelerator.
• Checked the federadted credentials that were created.
• Ran the CI and CD workflows

As part of this Pull Request I have

• Checked for duplicate Pull Requests
• Associated it with relevant issues, for tracking and closure.
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Updated relevant and associated documentation.

[richeney]

It looks as if #135 is in a similar but unrelated area. I suggest that the two changes are combined.

(Daniel's change is compensating for variance in username / org name case, as opposed to the immutable claim format, but they both change the subject.)