Release v0.5.0

Changes in this release:

• Accept the base Civic issuer alongside the tenant-scoped issuer during token validation, fixing unexpected "iss" claim value 401s for base-issuer tokens (client_credentials, token-exchange output) when dynamic client registration is enabled (NEXUS-2342).
• Add issuerValidator option to fully override the default issuer check for broader multi-tenant deployments.

See CHANGELOG.md for details.