How Jenkins authenticates itself to the OpenID Connect provider's token endpoint