muster release v5.18.0

oauth.server.allowPrivateIPRedirectURIs (Helm: muster.oauth.server.allowPrivateIPRedirectURIs): a client’s redirect URI may resolve to a private address. On a cluster whose own hostnames resolve to an internal load balancer the authorization-time check rejected every platform-hosted client’s callback with redirect_uri: hostname resolves to private IP address (DNS rebinding protection) – klaus-gateway’s Slack sign-in ended in server_error: Failed to start authorization flow right after allowPrivateIPClientMetadata had let the client through. Off by default; emits a startup warning when set; exact redirect-URI matching is unchanged. (#1201)