muster release v5.7.21

A forwarded-token rejection is now attributed to the token’s audiences, not only its issuer. When a forwardToken backend answers the forwarded ID token with 401, the log line and the auth://status detail used to name the token’s iss and hint at the issuer’s JWKS — which sent an investigation towards JWKS and egress when the backend had in fact trusted the issuer and refused the token’s audience (agent-manager on gazelle: the Backstage client’s audiences were not in its trusted set). The diagnostic now reads forwarded token iss=…, aud=[…]; the backend must trust this issuer's JWKS and one of these audiences, and when the backend’s 401 carries a WWW-Authenticate challenge its error and error_description are quoted as well (agent-manager sent no identity token to act with towards the Kubernetes API; muster used to drop the header at the transport). auth://status returns the same account in the server’s error field next to reauth_required / sso_attempt_failed, so a client can show why SSO failed instead of a generic pointer to an administrator; muster auth status --server <name> prints it as Reason:. Audiences are client identifiers, and the token itself is never logged. (#1141)