feat: add support for trusted publishing to cli

[netomi]

This adds support for trusted publishing to the cli.

Some things that are worth to consider:

• the deleteUrl included in the response for creating a token can not be used from the cli as it requires an active session, so we should provide a dedicated endpoint for such use
• Claude suggested to have an endpoint for audience discovery:

Audience discovery. Defaulting to registryUrl works for open-vsx.org (registry URL == webui URL), but breaks on any deployment where they differ, and the failure is an opaque 403.
Cheapest fix: have the server advertise it — e.g. return the expected audience in an unauthenticated GET /api/-/trusted-publishing alongside the provider list, and let the CLI fetch it and
fall back to registryUrl. Otherwise every such deployment needs --oidcAudience documented. Your call whether to add that endpoint in this branch or ship the flag-only version.

Also included is a validation fix for the backend that was spotted by claude.

[cstamas]

I would rather make server "recognize" the token as once usable, and just delete it on use.