Htgettoken

- Add httokendecode command
- Add RELEASE_PROCEDURE file

- Add --vaulttokenminttl option.
- Add --web-open-command option, and default it to xdg-open only when $SSH_CLIENT is not set.
- Send the extra 'server' parameter recognized by htvault-config >= 1.5 when --secretpath=secret/oauth/creds/%issuer/%credkey:%role, to use shared vault secrets instance (will be default later).
- Use the new pyinstaller 4.5 exclude_system_libraries() function instead of the previous hack to exclude system libraries from being bundled.

- Add --kerbprincipal option
- Change the default kerbpath to include issuer and role
- Limit oidc polling to 2 minutes
- Disable oidc authentication when running in the background, that is, when none of stdin, stdout, or stderr are on a tty
- Document that audience can be a comma or space separated list
- Updated pip-installed dependent packages to latest versions

- Fix working with a kerberos domain that is missing from krb5.conf
- Extract more formatted information from http exceptions
- Improve format of printed kerberos exceptions

- Integrate with htcondor, including these changes:
- Change --authpath option name to --oidcpath.
- Add --noidc option.
- Add --vaulttokenttl option.
- Make --vaulttokenfile default to /dev/stdout if the ttl is more than a million seconds, and also require it to start with /dev/std or /dev/fd if the ttl is more than a million seconds.
- Add --vaulttokeninfile option.
- Add --nobearertoken option.
- Add --showbearerurl option.
- Send progress output to stderr if --vaulttokenfile is /dev/stdout or --showbearerurl option is enabled.
- Use a separate version number for the python library downloads tarball.

- Add --credkey option.
- Add --vaultalias option.
- Add --nokerberos and --kerbpath options.
- Change the name of the --vaultrole option to --role; the short name -r remains unchanged.
- Fill out the man page and add a html version of it to the source, generated by a Makefile.