Fix nil dereference on invalid OIDC refresh token

[gmolto]

This PR fixes a crash when oidc_refresh_token is present in the config but is not a valid refresh token.

Previously, oscar-cli could hit a nil pointer dereference in pkg/cluster/cluster.go (line 329) while trying to extract claims from an invalid token. With this change, the refresh token is validated before its claims are used, and the CLI now returns a proper error instead of panicking.

Changes

• Hardened OIDC refresh token handling in pkg/cluster/cluster.go (line 329).
• Added explicit validation for required claims such as issuer, scope, and client ID.
• Improved error handling for malformed tokens, invalid issuer URLs, non-2xx OIDC token endpoint responses, and missing access_token fields.
• Added regression and happy-path tests in pkg/cluster/cluster_test.go (line 263)