thv 0.47.0 డౌన్‌లోడ్

## Changelog
* e30f1bf371f234396cfdc45b990d2cdc250fd9db: Allow Cedar delegation without an upstream session (#6506) (@jhrozek)
* 4440a7ddffe64db28c52b7fbf45cb89bf488493a: Allow embedded auth servers without upstreams (#6452) (@jhrozek)
* 2ad87a3b3fb44bb0d9c3fb96791f43dc088e93c2: Bound and close HTTP client connection pools (#6480) (@tgrunnagle)
* fd1e7b5874691cb4b019e9783b99357e53a10f1e: Bound and drain hand-rolled HTTP transport pools (#6495) (@tgrunnagle)
* 3b6e59353956616e9997c7ef914fd641e91bd288: Bump google.golang.org/grpc from 1.83.0 to 1.83.1 (#6486) (@dependabot[bot])
* 89fedde52d9a96aeff1af37016980336ea6dacc4: Bump x/crypto to v0.56.0 and adopt go 1.26.0 (#6494) (@tgrunnagle)
* 074c3c690a1dbc341a1a2053da63fde4c0e2dc48: Cancel superseded main validation runs (#6537) (@rdimitrov)
* 0280cf988dc3ce69c84514c7d1ffaeba08deb85d: Cancel superseded pull request checks (#6533) (@rdimitrov)
* 4037560aafa78ca706815815a1e5a60317020135: Close leaked test validators and fix validator-sharing docs (#6504) (@tgrunnagle)
* 788893308ee21be2a9193ac90f4b0eeb4810a048: Define SPIFFE trust configuration (#6467) (@jhrozek)
* 6c1439633651a225da378f33bc7fff65d60a3087: Degrade transient optional list failures in Modern enumeration (#6348) (@lorenzozanee)
* d859bfe06e62443cf9767f864ba06d294faf24fd: Detect GUI editors without a PATH binary (#6481) (@stantheman0128)
* 720209d1d7f7408b53adb547c51f48b1f8c6ed0c: Document SPIFFE association declarations (#6501) (@jhrozek)
* 4aa79fcca594c7881fd215060ba5c692df4b62ef: Encode empty mirrored parameter headers (#6485) (@jhrozek)
* 031675ec5d7439c823f03d5a6f0581956ff2a184: Exclude the x/crypto/ssh DoS advisories from govulncheck (#6502) (@jhrozek)
* 2714d76404bb17c221f4e9b99c61288a6bc92bb7: Expose SPIFFE client-auth registration through the operator CRDs (#6500) (@jhrozek)
* 500f4784984fd5a24eccb8cbabf8b9dd1814a623: Expose canonical inbound grants in CRDs (#6499) (@jhrozek)
* 65eaa1bd05b5cec0b7770f83beeeb5e8f1cb50a9: Fix VirtualMCPServer reconciliation (#6465) (@jhrozek)
* 7f0d08f8641aaca25dbe4772145703facb518af3: Grant CIMD clients the server's allowed audiences (#6490) (@alex-feel)
* 0fb54d437cee848ec7c97c4fa415047ec8b2f63f: Guard OIDC discovery against private IPs (#6455) (@jhrozek)
* ee527be78ea9116868266015e14142b32028d2c9: Honour a pinned cosign key on sync and upgrade (#6478) (@samuv)
* 7bbc1189cd8b424fd8c431a1525bc500d1b120ed: Intersect default scopes with scopes_supported when scope is omitted (#6283) (@alex-feel)
* 0a740048a0469bb93034d95c196343e980cf0c0a: Log MCPRegistry deprecation at most once (#6366) (@asjdf)
* a83059cd5f7f8973aa739fbf2e02d8d5a3888d26: Make proxy request-body limit configurable (#6298) (@Sanskarzz)
* 2cff289f55fff4f4f5f7718dc93aef88a7d6c85d: Merge commit from fork (@jhrozek)
* e180acd80dd2048fc7a7a275e12e23b655bd1da6: Merge commit from fork (@jhrozek)
* 71b0576840c97a9f5544124df44183480b5eb831: Merge commit from fork (@jhrozek)
* eb04008c532aa08dc681aadb4483e02630a61d3d: Merge commit from fork (@jhrozek)
* 9653ef562fd9ce98a63cbe2f35c2f6e8c83d4f7c: Merge commit from fork (@jhrozek)
* 4a41d71a6652dc0b958706a1c46c95d97b88fd18: Merge commit from fork (@amirejaz)
* 6b40bf3d53be0b491c3c7af0b0e189bd911de881: Normalize canonical inbound grants (#6473) (@jhrozek)
* 4fd27ef70d147c3fc8c69d6159dfcdd34abb8616: Persist resolved CIMD clients so Redis session rehydration finds them (#6284) (@alex-feel)
* b5d52b6a9170936925aea6f17f268c4ad2a0be0a: Preserve config-level outgoing auth across backend watcher reconciles (#6513) (@alex-feel)
* d1d76c3b3afca0c5ac6b60f35df40a7cc605f08f: Record a pinned cosign key in the lock schema (#6444) (@samuv)
* 6f73212989f3bdd1f1499e68a2c91f8480d2fc00: Reduce cached token restore complexity to fix CI (#6535) (@rdimitrov)
* a919f589f0855ce6f9dc4b3c46ab73cf92e097a0: Release per-issuer JWKS refresh workers on auth-server shutdown (#6493) (@tgrunnagle)
* 28acc89b418913aafe25552fd5156445d39adf2d: Release v0.47.0 (#6539) (@toolhive-release-app[bot])
* 311cf92763293210517bf9109096082d4222d479: Report key-signed artifacts as such at install (#6443) (@samuv)
* 30e832a70fe0e7a83cb6d2e1302da3fcfb428c29: Restart health checks when a backend's auth config changes (#6510) (@alex-feel)
* 9549c9a853e5f97c580fe62788345a30451a195e: Restore go.mod patch-version lint with floor-friendly regex (#6503) (@reyortiz3)
* c00c09dcb6417352ffefa6d9eb146551360e62d1: Route Claude workflows through the Stacklok LLM gateway (#6498) (@eleftherias)
* da85cdbf1a175721b3ac7a780a3ba0eee3f276b8: Sign plugin pushes and remove the lock feature gate (#6438) (@samuv)
* 7b491f7a5cb33c17f78bc4b27380e97d5e70b548: Suppress OAuth callback Referer (#6519) (@adrian-muon)
* 3a700c5c0f660ab17a33f958fa3cdc66c465e391: Trust private CAs for RFC 8693 trusted issuers (#6437) (@jhrozek)
* 34d0bbab9c2c4de90de82a1775f595dc351c977b: Update README after Cloud UI retirement (#6456) (@danbarr)
* 166a226d1a025c2a268cf3b21a71f1654c560bdf: Update VS Code LLM integration (#6492) (@blkt)
* 4f26111e43529ce4ae79077e062d00413092606f: Update anchore/sbom-action action to v0.24.2 (#6460) (@renovate[bot])
* e3b94c11d5672c2d31385f049b26d0e373210f93: Update anchore/scan-action action to v7.4.2 (#6461) (@renovate[bot])
* 42cb04ace3b4644fa7e442471cbfb2f23655beb9: Update anthropics/claude-code-action action to v1.0.217 (#6462) (@renovate[bot])
* 32c2f17cf3195194f84d57afa7e1805712633b94: Update github/codeql-action action to v4.37.9 (#6463) (@renovate[bot])
* 22f8244b94845f039c03effd7baaa8c98a8db59a: Update module github.com/stacklok/toolhive-catalog to v0.20260831.0 (#6530) (@renovate[bot])
* c4f6cb4a35fbce1a94f05e73dbc1eecd640df422: Update module github.com/stacklok/toolhive-catalog to v0.20260908.0 (#6534) (@renovate[bot])
* 1e80f9deeb5fbe39531663456a50b085ebaa8784: Verify key-signed plugin installs against a public key (#6524) (@samuv)
* 1af4f80d203578c103e14567e4328db031401f1f: Verify key-signed skill installs against a public key (#6447) (@samuv)
* 5250f41f4c10d9a15bbf427d7386fc3f90cdf290: fix(authserver): scope upstream-token callback cleanup to the chain's providers (#6476) (@tgrunnagle)
* 8b6d670cd552ab33074e0cc7ec451941b29ff71e: fix(operator): detect vMCP volume drift (#6299) (@jstar0)
* 6e6c67b0e54f72d73499a8ef80ae4feeab0e3f15: fix(operator): warn when VirtualMCPServer inline telemetry is ignored (#6408) (@RaviTharuma)
* 450ba5f94cf9fe550dac9562cabfc8f95784b1b6: test: cover OIDC upstream allowPrivateIPs in BuildAuthServerRunConfig (#6288) (@alex-feel)