[matheuscscp]

Closes: #71
Part of: fluxcd/flux2#6103

Introduce mirror.plugin.fluxcd.io/v1beta2:

• Rename credential claims and providers, require credential.type, move hosts[].username under credential, and add hosts[].provider: generic.
• Replace tls.serverAuth/clientAuth with tls.path, inline ca.crt/tls.crt/tls.key, or tls.spiffe.serverIDs.
• Convert v1beta1 renames and the TLS shapes that map exactly; decode v1beta1 leniently and print the migration guide when conversion fails.
• Also stops the envelope transport from rewriting the registry-issued Bearer token for username credentials. Unrelated cleanup; called out here.

[matheuscscp]

@stefanprodan I did 5 rounds of adversarial reviews.

[matheuscscp]

Added an API version bump to v1beta2, users with v1beta1 will see the following (soft) warning:

warning: apiVersion "mirror.plugin.fluxcd.io/v1beta1" is deprecated and will be removed in a future release; the config is being migrated to "mirror.plugin.fluxcd.io/v1beta2" in memory.
v1beta2 is a breaking change:
  - credential.type is required (set type: jwt)
  - credential.aud -> credential.audiences
  - credential.iss -> credential.issuer
  - credential.sub -> credential.subject
  - credential.exp -> credential.expiration
  - hosts[].username -> hosts[].credential.username
  - credential provider jwt-svid -> spiffe
  - tls clientAuth/serverAuth provider x509-svid -> spiffe
  - tls serverAuth spiffe authorizeAny is removed (set serverID or trustDomain)
See docs/config.md for the full specification.

[matheuscscp]

The object-level APIs may still change in RFC-0014. Moving this to draft.

[stefanprodan]

LGTM

Thanks @matheuscscp 🏅