bridge, commands: fix credential selection and dangling identity handling - #1663

auth.List returned credentials in whatever order the keyring backend
listed its keys, which is arbitrary. Callers in all bridges (github,
gitlab, jira importers and exporters) simply use creds[0], so when
several matching credentials exist, e.g. after a token was regenerated
or a bridge configuration was retried, the bridge could keep picking an
old, revoked token. The newly added valid one was silently ignored and
every pull failed with an authentication error from the remote.

Sort the result by creation time, most recent first, with the ID as a
tie breaker so that the order is fully deterministic. Stored timestamps
preserve full RFC3339Nano resolution so credentials added in the same
second still sort deterministically newest-first, while remaining backward
compatible with legacy integer timestamps. Adding a fresh credential now
supersedes older ones for every caller without having to touch each bridge.

Bridges for self-hosted trackers (gitlab, jira) only select credentials
carrying a "base-url" metadata matching their configuration, but
"bridge auth add-token" had no way to set it. Tokens added through it
were therefore never used by those bridges, without any warning.

Add a -b/--base-url flag, consistent with "bridge new", which stores
the value as base-url metadata on the token.

Also report a clear error when --user doesn't match any identity.
"-u" means --user here but --url in "bridge new", which makes it easy
to pass a URL by mistake; previously that produced only the cryptic
"identity doesn't exist".

The man page and markdown documentation are regenerated.

…lients

In githubExporter.cacheAllClient and gitlabExporter.cacheAllClient, the
loop over credentials built each client from creds[0] instead of the
iterated cred. If tokens existed for multiple accounts, every identity
client was configured with whichever token appeared first in the slice.
Because auth.List orders credentials newest-first, adding a token for a
secondary account caused exports to run with that account's token, even
for the configured default login.

Build each identity client and assign the default token from the
matching iterated token instead of creds[0].

… matching

When bridges for trackers like GitLab and Jira query credentials by base
URL, auth.List uses exact string matching on metadata. Differences such
as a trailing slash (for example, the default "https://gitlab.com/"
versus user input "https://gitlab.com") caused credential lookups to fail
silently, making valid tokens unusable by the bridge.

Introduce auth.NormalizeBaseURL to canonicalize URLs by lowercasing scheme
and host and removing trailing slashes. Apply this normalization when
storing base-url metadata in "bridge auth add-token" as well as in GitLab
and Jira bridge configuration. In auth.List option matching, compare
base-url metadata values after normalization so queries match regardless
of trailing slashes in either the stored credential or the query filter.