v4.16.0

## Changelog
### Features
* b45f7bcbbc78073adfe7022f24a50880e8400302 feat: add .well-known metadata file
* bffa2978b91bd8c16f525866936a8ad12df715ed feat: add DCR switch and support form_post and hybrid flow in consent page
* 77709d95360301b483fef023edffde6dd61e1a88 feat: add OpenSSF Best Practices badge to README
* 3c6aede22586f743729bf96e19a327d3a26fb89c feat: improve OIDC conformance for hybrid flow, prompt and max_age
* fbc08fea9db979dbd7f7505f3abe73476b759f3e feat: link to the Casdoor Authenticator app in MFA setup, MFA accounts and README
* c6c6af74126a0c6cbe5de17f4a2b1ad5ff9d8d46 feat: publish the Helm chart as casdoor on GHCR and Artifact Hub
* 118a2a5cdc98956c686979d62938411d317c43ca feat: publish the frontend build to npm and load it from a CDN
* bf10210ca2dd35f2cdc110ea2f47df2d4b38f0a8 feat: serve robots.txt from the frontend build
### Bug fixes
* dd17031827b338a74bd5dc8cfdaaa7c407e0a391 fix: align MCP request parsing and add organization LDAP password and RADIUS switches
* 4cfbf71d1bd0bdc4c7d999aaa79754bc92c4cbdd fix: allow syncers and adapters to use a trusted database server
* 1455c31d527f9d473cfd5c34d72f6cd7b54da3bc fix: block device-login session escalation, permission adapter table abuse and password-only sign-in policy bypass
* cfd68c5918f6db6aa9fb7f7996f5218fbaa298e8 fix: block reusing another organization's cert name as JWKS kid
* 565ec337bac8d6769420361266e3011da63fe631 fix: change run-syncer API from GET to POST
* 872c4bf4c2f7e7377cf153961bab4075b4535e27 fix: fall back to shared swagger folder for thin instances
* a5cebbdb97257ceaf629b4424784f9a904a6d7e6 fix: harden auto sign-in, CAS tickets, SAML signing, form CSS and WebAuthn policy
* 960c18579a388d2404c0f50f80d9857d0a2d1262 fix: hide password salt and restrict upload file types
* 4bd6d54c00d60706c9357eeaa2910cd71c6f2807 fix: keep the login page working for sessions limited by a cross-org token
* 289bc94dc72414f0af99f45fc59a63c52c8f50e9 fix: load lazy chunks and fonts from the same CDN as the main bundle
* aaffc7861872165605240002e0185783cb7ff1e3 fix: mask secrets in audit records and cap request body size
* 35018369a40b8b63916b45e98373dbb6601ad51c fix: remove public JWT key files and detect the public built-in cert by hash
* 8a09828d6ee3e022c0e62bdf04ccbb3a63d301c0 fix: remove the run-casbin-command and refresh-engines APIs
* dbc3e8c2e004f3d55fe8df7d30ba2d49b246fe38 fix: return database errors instead of swallowing them in object layer
* 332f28d5625250f209e6a4db5d7939a7a02a2255 fix: show the sign-in page instead of an error when auto sign-in can't issue a code
* b467fbd462391e9dc212fe16d51ff069c8bd9678 fix: skip publishing casdoor-web when the version already exists
* 7b470895f998fe7b25765f0f782a874e58629b8d fix: verify SSH host keys and sanitize custom HTML of non-built-in apps