[FEAT cloudctl] - Add logon subcommand with version-pinned kubelogin download #76

User Story

As a cloudctl user, I want cloudctl logon to handle OIDC authentication for any context automatically, so I don't need to install or invoke kubelogin myself.

Description

Download a pinned kubelogin binary from GitHub releases (zip, SHA-256 verified). cloudctl logon detects the auth type (exec-plugin / auth-provider / token) from the kubeconfig and invokes kubelogin with appropriate flags. Supports --via-oidc keyboard flow for restricted network environments.

Acceptance Criteria

• kubelogin downloaded at pinned version and cached in XDG cache dir
• Auth type detected from kubeconfig: exec-plugin, auth-provider, token, unknown
• Token-based contexts skip logon with informational message
• Exec-plugin contexts inform user that explicit logon is not needed
• Auth-provider contexts invoke kubelogin with --kubeconfig and --context
• --via-oidc flag triggers keyboard/authcode flow
• Extra kubelogin args forwarded and take precedence over defaults

Reference Issues

Epic: #70