os-usque 0.2_17

Adds a selectable Cloudflare Access service-token enrollment method for egress clients while preserving browser-assisted egress and Mesh registration. The new flow accepts organization, Access Client ID, and Access Client Secret, uses a one-time owner-only handoff and MDM file, and does not persist the service-token credentials in config.xml. The native port is pinned to the reviewed usque-rs-bsd 0.8.1 Access-enrollment commit and includes quick-xml. Validated with 38 enrollment tests, OPNsense plugin packaging, and FreeBSD stage-qa/check-plist.