v4.12.0

## Changelog
### Features
* 9f1300532a7fbffe0d7d39fdde1c098403cfd970 feat: add application-level token group format option
* 3377f35609b84c54d4bea0fd5b48c54a70948abd feat: support OIDC prompt=none on the authorize page (#5884)
* de6fc6d2621e835ca10dbee0a99866921ba04a50 feat: support RFC 9207 iss parameter in authorization responses
* 980ad122ed00e1cf88198f9b9e237c53e0499383 feat: support max session count for exclusive signin
* 6c18f6c6627c0afb52c2799f11e6253a1f99c8c8 feat: upgrade React to 19.3.0 in web
### Bug fixes
* 91fc9242907778d51a4c9908e2e2dd7f30f75000 fix: accept JWT-Standard subject tokens in token exchange
* 865120ccaf4c9773ee97eca1899cdca831d4dc74 fix: add timeout and SSRF guard to SAML and OIDC logout requests
* 7090ebcd3926cd9e01b6641a79de70eb2b4730bf fix: align default tag, storage provider and UID number inputs
* 611a83796d80d938f2e6ec9fe8294e44df539e39 fix: allow org admins to upload Direct resources to their own storage providers
* ada08ecd10cbf158f593dee23a8bab63efecf995 fix: block DSN injection and cross-tenant casbin adapters and harden CAS, DPoP and MFA checks
* 8eb7b2ec0ae4a90593d5be4bf4abeb48aa0390de fix: block MCP tool allowlist bypass and MicrosoftOnline email takeover
* 11114ac5188597674bad48117bd6b2847f77c52f fix: block MFA bypass via required-MFA prompt and forbidden users' access keys
* 1bd326251ae15032a511137e2a210d209b5f929a fix: block OAuth username binding takeover, cross-tenant app login and group injection
* 6af35aff806f6ec4c4892cec5ec486fa1bf8b7cc fix: block SQL issue via webhook event sort field and syncer column names
* 181cf43407abd039e60b6583ab447243faeb03dc fix: block app identity spoofing, forged Google One Tap tokens and unverified phone binding
* 55f790a9e5d6a6181d913614ed669faffc4802d0 fix: block captcha bypass, DCR token abuse, tenant SSRF and balance races
* d044c86f41b43ea36c0c3415c2a64bfa71c36464 fix: block cross-org token escalation, CAS open service, face image SSRF and secretless refresh
* de30b9345f1fc48bbe61066888eefd25cde8249d fix: block cross-origin cookie writes, client-chosen access keys and tokens of pending sign-ins
* 884fcb4e1dfaadc3254281aa487f76bfe6ff188c fix: block cross-tenant LDAP, cert, order and intranet access abuse
* 46260231e9830be36daa2e9f75a0c6097dcdca46 fix: block cross-tenant keytab, SSRF, WeChat ticket and leaks
* a8798c4238915646d3f6c5d435678add56b1c38a fix: block javascript: URLs in CAS, OAuth and SAML logout redirects
* 5b434b057cc4669c91961eaab834e54a39270659 fix: block payment notify races and tenant DB access to intranet hosts
* 8d26455d1c409df3b25f0711ceaf357c4dce1d1c fix: check link request origin, verify proxy TLS and group removal rule
* 9e650e3c3fce851339db949d5f89b79ee8896903 fix: enforce MFA on WebAuthn sign-in and block auth code replay
* 6fb5edcc9109d2206e9ee40fe8e0fb28b5165c54 fix: enforce sign-in policies for URL password login and block unverified email binding
* d07f796a11281d163b5035cf76b53cfd5bb0de3a fix: harden CasWAF gateway and MCP tool sync against file read, token and SSRF abuse
* 09ace3880483d78a28bff963c52a8175b10e3e89 fix: harden OAuth auto sign-in, RADIUS TOTP limit and LDAP panic handling
* 7fdec965c6f1c30b9326b96ff9368ad20151f265 fix: harden client IP resolution, mask provider secrets and block LDAP bind for MFA users
* d32dac1601994b23693bd6d93cc0b8258c5d59a7 fix: stop ADFS from disabling TLS checks process-wide and route Casdoor IdP token requests through the guarded client
* 0d5e6a67dba99c26574c89572e3dc06e5a5a06b8 fix: upgrade dependencies and refine CORS and redirect URI matching
* 72e8750cdda1e7e993fb0a57ffabc9a8ec2c07dc fix: use RegionSelect for the Country/Region account item in the new web UI (#5881)
* 5164da5375789d8f12538c6bac642eb375d42fe9 fix: use request language instead of hard-coded "en"
* 3f23619d70a84b47a1dbbc35ecc0797cc9213982 fix: validate organization default application and application admin check
* e24a907810860b91bb4c060bec7e90132438eef5 fix: validate syncer table names and block syncing Casdoor's own DB