Fix base64 encoding for JWT token (#3367)

The eng/common/scripts/login-to-github.ps1 script was failing because it was using the standard Base64 encoded
  signature returned by Azure Key Vault directly in the JWT, instead of converting it to Base64URL format (which
  replaces + with -, / with _, and removes trailing =).

  I have fixed the script by adding the necessary character replacements and also added a 10-second clock skew buffer
  to the iat (issued at) claim to ensure validity.

  The script now runs successfully and logs in as azure-sdk-automation[bot].

  Changes made:

   - Modified eng/common/scripts/login-to-github.ps1:
    - Converted the signature from Azure Key Vault to Base64URL format.
    - Subtracted 10 seconds from the iat claim to account for potential clock skew.

  Verification:

   - Ran the script and confirmed it successfully resolved the installation ID for "Azure" and obtained an access
  token.
   - gh auth status output confirms successful login.

Co-authored-by: Wes Haggard <Wes.Haggard@microsoft.com>

Author: azure-sdk

eng/common/scripts/login-to-github.ps1

@@ -57,9 +57,17 @@ function New-GitHubAppJwt {
     [Parameter(Mandatory)] [string] $AppId
   )
 
-  function Base64UrlEncode($json) {
-    $bytes = [System.Text.Encoding]::UTF8.GetBytes($json)
-    $base64 = [Convert]::ToBase64String($bytes)
+  function Base64UrlEncode {
+    param(
+      [string]$Data,
+      [switch]$IsBase64String
+    )
+    if ($IsBase64String) {
+      $base64 = $Data
+    } else {
+      $bytes = [System.Text.Encoding]::UTF8.GetBytes($Data)
+      $base64 = [Convert]::ToBase64String($bytes)
+    }
     return $base64.TrimEnd('=') -replace '\+', '-' -replace '/', '_'
   }
 
@@ -70,7 +78,7 @@ function New-GitHubAppJwt {
   }
   $Now = [int][double]::Parse((Get-Date -UFormat %s))
   $Payload = @{
-      iat = $Now
+      iat = $Now - 10 # 10 seconds clock skew
       exp = $Now + 600  # 10 minutes
       iss = $AppId
   }
@@ -97,7 +105,7 @@ function New-GitHubAppJwt {
     throw "Azure Key Vault response does not contain a signature. Response: $($SignResultJson | ConvertTo-Json -Compress)"
   }
 
-  $Signature = $SignResultJson.signature
+  $Signature = Base64UrlEncode -Data $SignResultJson.signature -IsBase64String
   return "$UnsignedToken.$Signature"
 }