muster release v5.17.0

oauth.server.allowPrivateIPClientMetadata (Helm: muster.oauth.server.allowPrivateIPClientMetadata): a CIMD client_id URL – the Client ID Metadata Document an OAuth client such as klaus-gateway self-hosts – may resolve to a private, loopback or link-local address. Needed where the platform’s own hostnames resolve to an internal load balancer (a management cluster reachable only over VPN): until now the SSRF guard rejected such a client with invalid_client: ... client_id metadata URL resolves to private/internal IP address and nothing in muster’s configuration could lift it, although mcp-oauth has had the switch (AllowPrivateIPClientMetadata). Off by default; emits a startup warning when set; PKCE and redirect-URI validation are unchanged. (#1199)