Reduce our dependency on ambient OIDC tests for error cases

[woodruffw]

Our ambient OIDC tests consistently catch regressions, but they only run on first-party merges and PRs. As such, they tend to catch regressions after they make it to main.

We should reduce our dependency on the ambient OIDC credential in some of our error testcases. In particular, things like SCT error case handling should be test-able offline, since we can store the SCT as a test asset.