feat: add Organization Role Members, Connection event streams, and Token Vault access grants

[fern-api]

Changes

SDK regeneration from the Auth0 OpenAPI spec via Fern. Adds an organization role-members listing endpoint, connection lifecycle event-stream types, Token Vault privileged-access grants, connection OIDC discovery metadata, and organization third-party client access, renames the connection attribute identifier into per-attribute types, and renames the phone-protection backoff strategy value.

🆕 New endpoints / types:

• Organization Role Members - new organizations.roles.members sub-client with list on organizations/{id}/roles/{role_id}/members, backed by ListOrganizationRoleMembersResponseContent, RoleMember, and ListOrganizationRoleMembersRequestParameters
• Connection event streams - connection.created, connection.updated, and connection.deleted cloud-event types for event-stream subscriptions, covering the full connection options schema across strategies
• Token Vault access grants - grants (TokenVaultPrivilegedAccessGrant, carrying connection and scopes) on token_vault_privileged_access for client create/update/response
• Connection OIDC discovery metadata - discovery_url and oidc_metadata (ConnectionsOidcMetadata) on connection properties options and update-connection options
• Organization third-party client access - third_party_client_access (OrganizationThirdPartyClientAccessEnum, block/allow) on organization create/update/response
• Standard error bodies - NotFoundErrorBody and TooManyRequestsErrorBody response types

✏️ Modified endpoints (new properties):

• Confirmation prompt partial - confirmation member on PartialGroupsEnum, a new customizable screen for the Prompt Partials API
• Phone attribute default method - DefaultMethodPhoneNumberIdentifierEnum (password/phone_otp) backing PhoneAttributeIdentifier
• Network ACL curated-list match - auth0_managed on NetworkAclMatch, matching requests against an Auth0-curated allowlist
• Connection grant - organization_id on UserGrant

⚠️ Breaking Changes:

• Connection attribute identifier - the shared ConnectionAttributeIdentifier type is removed; the identifier field on email, phone, and username attributes is now EmailAttributeIdentifier, PhoneAttributeIdentifier, and UsernameAttributeIdentifier respectively. Update any references to the old type name
• Phone provider protection backoff strategy - PhoneProviderProtectionBackoffStrategyEnum replaces the none member with default. Update any references to the removed none case
• Offset-paginated roles - start, limit, and total on ListRolesOffsetPaginatedResponseContent are now required rather than optional
• Guardian SMS templates and Jobs errors - guardian.factors.sms.get_templates and jobs.errors.get now return nil on a successful response instead of a parsed response object

[tanya732]

LGTM