feat: add connection profiles, groups support, and org member effective roles; remove branding identifiers

[fern-api]

⚠️ Breaking Changes

• Branding identifiers removed — identifiers parameter removed from branding.update(); identifiers field removed from GetBrandingResponseContent and UpdateBrandingResponseContent. Ten associated types (BrandingIdentifiers, UpdateBrandingIdentifiers, BrandingPhoneDisplay, UpdateBrandingPhoneDisplay, and their supporting enums) are no longer exported from auth0.management.types. These settings now live exclusively on the theme resource (PATCH /api/v2/branding/themes/{id}).
• PhoneTemplate.id now optional — id was a required str on PhoneTemplate, GetPhoneTemplateResponseContent, CreatePhoneTemplateResponseContent, UpdatePhoneTemplateResponseContent, and ResetPhoneTemplateResponseContent. It is now Optional[str]. Code that accesses .id without a None check will require updating.

New Endpoints & Clients

• Connection Profiles — new sub-client with full CRUD (list, create, get, update, delete) plus template access (list_templates, get_template)
• Client Grants → Organizations — list() to retrieve organizations associated with a specific client grant
• Connections → Users — delete_by_email() to delete a connection user by email address
• Groups — members.get() to list group members; roles.list(), roles.create(), roles.delete() for group role management
• Organizations — groups.list() for organization groups; groups.roles.list/create/delete() for group-scoped roles; members.effective_roles.list() for a member's effective roles (including group-sourced)
• Roles — groups.get/create/delete() for managing groups assigned to a role
• Users — groups.get() for group membership; effective_roles.list() for all effective role assignments

Type Changes

• Tenant Settings — new security_headers field (CSP + XSS protection config), country_codes (phone identifier allow/deny list), and include_session_metadata_in_tenant_logs flag
• Connection Options — new id_token_session_expiry_supported field on OIDC and update connection options
• Client MyOrganization — new invitation_landing_client_id field across post/patch/response configuration types

Bug Fixes

• GET /client-grants/{id}/organizations — added 404 handling; raises NotFoundError when the grant does not exist (was previously an unhandled parse error)
• PATCH /token-exchange-profiles/{id} — added 409 handling; raises ConflictError when a profile with the same subject_token_type already exists (was previously an unhandled parse error)