feat(oidc): support refresh token flow without id_token

[appleboy]

Some OIDC providers (e.g. AuthGate) do not return an id_token in their refresh token response.
Pinniped's handleRefresh() previously required an id_token unconditionally, causing silent
refresh failures and triggering a browser-based re-login every time the token expired.

This PR adds an opt-in flag to allow the refresh flow to succeed without an id_token,
falling back to the access_token when building the ExecCredential response.

Changes:

• Add --skip-require-id-token-on-refresh flag to pinniped login oidc: when set, the refresh
  flow calls ValidateTokenAndMergeWithUserInfo with requireIDToken=false and returns the
  access_token as the credential when id_token is absent
• Add --oidc-skip-require-id-token-on-refresh flag to pinniped get kubeconfig: automatically
  embeds --skip-require-id-token-on-refresh into the generated kubeconfig exec args
• Add WithRequireIDTokenOnRefresh(bool) Option to pkg/oidcclient; defaults to true to
  preserve existing behavior for all other providers
• Extend tokenCredential() to accept *oidctypes.Token and fall back to AccessToken when
  IDToken is nil; extract applyTokenToStatus() helper to remove duplicated logic
• Add nil guard with a clear error message when --skip-require-id-token-on-refresh is used
  together with --enable-concierge (incompatible combination)
• Update OIDCClientOptions interface and its GoMock implementation
• Add unit tests covering the new happy path, default behavior preservation, and refresh failure

Release note:

Add --skip-require-id-token-on-refresh flag to pinniped login oidc and
--oidc-skip-require-id-token-on-refresh flag to pinniped get kubeconfig.
When enabled, the OIDC refresh token flow no longer requires the provider to
return an id_token, and falls back to using the access_token as the cluster
credential. This is intended for use with non-Supervisor OIDC providers (such as
AuthGate) that omit id_token from their refresh token response. Default behavior
is unchanged. This flag is incompatible with --enable-concierge.

[netlify]

✅ Deploy Preview for pinniped-dev canceled.

Name	Link
🔨 Latest commit	225ffe5
🔍 Latest deploy log	https://app.netlify.com/projects/pinniped-dev/deploys/6a3b815618f7c50008486f88