muster release v5.26.0

muster auth login renews the stored ID token. A valid session is still reused, but the session’s automatic refresh renews the access token only: the OIDC ID token in ~/.config/muster/tokens/<hash>.json kept the exp of the first sign-in, so the CLI carried an ID token expired for weeks – signed with a key the identity provider no longer publishes – while muster auth status said Authenticated. Now login signs in again through the browser when the stored ID token has expired (or expires within 30 s), and always with the new --force; the stored session is replaced only when the new sign-in completes. muster auth status and muster auth whoami show the ID token’s expiry (ID token: expired 12 days ago (renew with: muster auth login)), and the new muster auth token [--id] prints the access token or the ID token alone on stdout for other clients – a script calling an API that validates the person’s ID token – and refuses an expired ID token instead of handing it out. (#1268)