muster release v5.15.0

oauth.mcpClient.tokenExchange.allowPrivateIP (Helm: muster.oauth.mcpClient.tokenExchange.allowPrivateIP): the token endpoint of a remote Dex muster exchanges tokens with (spec.auth.tokenExchange.dexTokenEndpoint) may resolve to a private or loopback address – a management or workload cluster whose Dex sits behind an internal-only load balancer. Until now only --extra-ca-file lifted the token-exchange client’s SSRF guard, so an exchange against such a Dex failed with a DNS-rebinding error although the endpoint was reachable. Off by default; emits a startup warning when set; TLS verification is unchanged.