v0.28.70

Changes

Add shared OpenID discovery cache for JWT and introspection (#4400)

Introduce an opt-in, process-wide OpenID discovery cache shared by
jwtValidation and all eight oauthTokenintrospection* filters.
Disabled callers continue to fetch discovery on every filter creation,
bypassing the cache and its global lock entirely.

When enabled, successful discovery documents are keyed by exact issuer
URL. Cache hits during route creation send no HTTP request, so warm
routing rebuilds can survive an issuer outage. Misses hold a global
write lock through the HTTP request and JSON decode. Failures are not
cached and there is no entry limit.

A shared hourly cleaner replaces the whole map on each tick. Library
owners enabling the cache via TokenintrospectionOptions must acquire a
cleaner with StartOpenIDConfigCacheCleaner and release it after
routing teardown; Skipper's run acquires one automatically when
EnableOpenIDConfigCache is set.

closes #4388

---

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.28.70 skipper --help