muster release v5.35.0

oauth.server.allowPrivateIPClientMetadataHosts lets a listed CIMD host resolve to a private address, and the CIMD fetch trusts --extra-ca-file. A CIMD client on a private hostname (an internal load balancer, a VPN-only platform) needed allowPrivateIPClientMetadata, which lifts the SSRF guard for every host, and one served under an internal CA failed TLS verification even with that CA in --extra-ca-file. The new list (Helm: muster.oauth.server.allowPrivateIPClientMetadataHosts, empty by default) lifts the guard for the hostnames listed only, mirroring trustedIssuers[].allowPrivateIPJWKSHosts; every other host keeps it, at validation and at connection time. The CIMD fetch now verifies against the --extra-ca-file pool, the system roots plus the operator’s CA, as the forwarded-token JWKS client already did; without --extra-ca-file it keeps the system roots. Prefer the list over the bool, which stays for an installation where every hostname is private. Requires mcp-oauth v1.6.0. (#1396)