muster release v5.33.0

Kubernetes ServiceAccount-token trust. muster is not a gateway for ServiceAccount tokens: callers present a Dex ID token, which muster forwards or exchanges. oauth.server.trustedIssuers[].allowedClaims, added to pin a system:serviceaccount:<namespace>:* subject for the retired kagent ServiceAccount-token bridge, is removed from the config and the chart values, as are the ServiceAccount examples in the config reference and the values, and the ServiceAccount identities in the tests. A config that still sets allowedClaims has it ignored: remove any ServiceAccount issuer from trustedIssuers before upgrading. trustedIssuers is documented as the list of Dex issuers muster accepts; the config reference now lists allowPrivateIPJWKSHosts, subjectClaim and acceptedTypHeaders. (#1349)