v0.10.1 - Token client fixes and CI hardening

This release fixes a series of defects in the token clients and in the bucket and Knowledge Graph functions found in a review of the toolbox, makes the client that carries EBRAINS_TOKEN say what is wrong when that token expires, and tightens the CI workflows. No public functions, classes, or name-value options are added or removed.

Fixed

• Refreshing a token that came without a refresh token, as one given through EBRAINS_TOKEN does, ran the device-flow login and then a second, redundant refresh request that discarded the token just obtained. A failure of that second request was shown as "Token Refresh Failed" although the login had succeeded (#30).
• createVirtualBucket created every object without a file extension, such as README or LICENSE, as a directory, and a later downloadFile into that path was refused. An entry is now a folder only where the bucket says so: a name ending in /, or a directory content type (#30).
• authenticate handed the OIDC client id and secret to the token client in the field order of its options struct, so naming the secret before the id would have logged in with the secret as the client id. Both are passed by name now. Giving only one of the two raises EBRAINS:authenticate:IncompleteCredentials instead of authenticating with an empty id or secret (#30).
• getInstancesBulk took the identifier of a missing instance from the message of the server's error, which names the id for a miss but explains itself for anything else, so a permission error became an "identifier" that was looked up in the next stage and finally reported as a missing instance. Missing ids are now the requested ids the response did not answer, and an id the response leaves out entirely counts as missing where it used to be dropped (#30).
• decode_jwt read the token payload through javax.xml.bind.DatatypeConverter, which needs a running JVM and was removed from the JDK in Java 11. It uses matlab.net.base64decode (#30), and a live test decodes a real EBRAINS token to confirm it (#31).
• An expired EBRAINS_TOKEN failed with "Invalid client credentials. Please verify your client ID and secret." The client that carries such a token has no credentials of its own and tried to renew with empty ones. It now raises EBRAINS:IAM:MissingClientCredentials before any request, saying that a token from EBRAINS_TOKEN cannot be renewed by the toolbox, or, when there was no token at all, which options supply the credentials. Code that caught the MATLAB:webservices:HTTP400StatusCodeError of the old behaviour should catch the new identifier (#32).
• Logging in with the client credentials flow after any API call warned EBRAINS:IAM:CredentialsChanged, because the credential-less client that getTokenManager creates on the way held empty credentials. A first login is no longer reported as a change of credentials; a change between two real sets still is (#32).
• Requests to the identity provider used the 5-second weboptions default timeout, which a slow connection could exceed at login. They now allow 10 seconds (#34).

Changed

• OidcTokenClient stores a token together with its expiry through storeToken, storeRefreshToken, and clearRefreshToken, so the two cannot drift apart. The token properties behind them are private; a subclass that assigned them directly should call those protected methods instead (#33).
• HttpClient.getDefaultHeader takes the ready Authorization field from getAuthHeaderField instead of building one from the raw token, so the toolbox itself no longer reads the token value. The public AccessToken property is unchanged (#35).
• The client secret of the live integration tests reaches MATLAB through the environment instead of being expanded into the command; test-code.yml, run-codespell.yml, and live-integration-tests.yml declare the token permissions they need instead of inheriting the repository default; and the test workflow runs on changes to .github, which it used to skip (#32).

Full Changelog: v0.10.0...v0.10.1