fix(ci): revert accidental third_party mount, use compose override for OIDC

The third_party:/opt/apps volume was accidentally uncommented in
docker-compose.yml. Without submodules checked out, this empty mount
breaks the Notes app installation hook in CI.

Fix: keep the mount commented in docker-compose.yml and add a separate
docker-compose.oidc.yml override that's only used for OIDC-requiring
profiles (oauth, login-flow) in CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/test.yml

@@ -78,10 +78,11 @@ jobs:
           composer install --no-dev
 
       # Start services with the appropriate profile
+      # OIDC modes need the override file to mount third_party into Nextcloud
       - name: Run docker compose
         uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
         with:
-          compose-file: "./docker-compose.yml"
+          compose-file: ${{ matrix.needs-oidc && './docker-compose.yml\n./docker-compose.oidc.yml' || './docker-compose.yml' }}
           compose-flags: "--profile ${{ matrix.profile }}"
           up-flags: "--build"