v0.1.5 — add allowed_refresh_initiators session-config key

Adds the DBSC allowed_refresh_initiators session-config key (spec) — out-of-scope hosts trusted to trigger a refresh on a cross-site-initiated navigation, which Chrome otherwise refuses as a timing side-channel mitigation.

Two ways to set it, three-state resolution:

• Fleet-wide default — Config(allowedRefreshInitiators: ['rp.example', '*.example.com']).
• Per request — RequestContext(..., allowedRefreshInitiators: [...]). null falls back to the Config value, [] forces the key off for that request even when Config sets a default, and a non-empty list wins.

Emitted through the single instructionsJson() funnel, so the key rides register, refresh, and sessionInstructionsJson() alike. Empty/whitespace-only entries are trimmed and dropped, and when the effective list is empty the key is omitted entirely — output is byte-identical to v0.1.4 unless you opt in.

No format validation, by design. Entries pass through verbatim (wildcards included). This is an allow-list: a malformed or dead entry only ever loses trust, never grants it, and validating a fleet-wide Config value would let a single typo break config loading for every session — worse than the silent dead-entry it would guard against. Consistent with how the rest of the library treats config.

Security note. Each listed host regains the authentication-state timing oracle this mitigation removes — list only relying parties you trust.

No API removals; the new Config and RequestContext parameters are optional with safe defaults, so existing call sites are unaffected.

Thanks to @joostdebruijn for the contribution.