Release v2.28.0

Added

• OIDC providers can use certificate files, certificate stores, Key Vault certificates, federated token files or managed identity instead of a client secret. Configure ClientCredential.Source; ClientSecret remains the default, and conflicting or incomplete credentials prevent startup. Certificate files preserve configured PFX passwords, including whitespace-only passwords. See Client credentials for configuration, rotation and Key Vault requirements. (#149)
• Certificate and federated credentials authenticate authorization-code redemption and pushed authorization requests using client_assertion. Expired certificate reloads retry at most once per minute, including unavailable replacements and loading failures. Managed identity defaults to the token-exchange audience for the authority's national cloud unless overridden. (#149)