[FEAT cloudctl] - Add logon subcommand with version-pinned kubelogin download

[onuryilmaz]

User Story

As a cloudctl user, I want cloudctl logon to handle OIDC authentication for any context automatically, so I don't need to install or invoke kubelogin myself.

Description

Download a pinned kubelogin binary from GitHub releases (zip, SHA-256 verified). cloudctl logon detects the auth type (exec-plugin / auth-provider / token) from the kubeconfig and invokes kubelogin with appropriate flags. Supports --via-oidc keyboard flow for restricted network environments.

Acceptance Criteria

• kubelogin downloaded at pinned version and cached in XDG cache dir
• Auth type detected from kubeconfig: exec-plugin, auth-provider, token, unknown
• Token-based contexts skip logon with informational message
• Exec-plugin contexts inform user that explicit logon is not needed
• Auth-provider contexts invoke kubelogin with --kubeconfig and --context
• --via-oidc flag triggers keyboard/authcode flow
• Extra kubelogin args forwarded and take precedence over defaults

Reference Issues

Epic: #70

[github-actions]

Thanks for opening this issue! 🎉

A maintainer will triage it within 5 business days. You can learn more about our issue workflow in the Issue Lifecycle documentation.

In the meantime, please make sure you have provided:

• A clear problem statement
• Steps to reproduce (for bugs)
• Expected vs actual behavior

This helps us route your issue faster.