Thumbprint list should only include CA fingerprint

[gabegorelick]

Is your request related to a new offering from AWS?

No

Is your request related to a problem? Please describe.

#2307 updated the OIDC provider thumbprint_list to include all certificate fingerprints. This was valid at the time, since that's what the Terraform docs recommended. However, the docs have since been updated to recommend against this (hashicorp/terraform-provider-aws#32847).

Here's what's in the latest docs:

thumbprint_list = [data.tls_certificate.example.certificates[0].sha1_fingerprint]

Additionally, including all fingerprints can cause issues since AWS only allows a maximum of 5 to be specified (#2632). So if you want to provide extra fingerprints, there may not be room.

I also think that official AWS tooling (Console, eksctl) only populates the CA fingerprint. Here's eksctl, for example:
https://github.com/eksctl-io/eksctl/blob/fb50ae558a9f9c3259fc42bda7cc3957a1d824d5/pkg/iam/oidc/api.go#L113

Describe the solution you'd like.

Go back to the behavior before #2307 and only include the CA fingerprint in thumbprint_list.

Describe alternatives you've considered.

Do nothing and live with the fact that this module behaves differently from what AWS and Terraform recommend.

Additional context

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days

[bryantbiggs]

if you'd like to open a PR, I'll merge it

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.