Added

• My Organization client access: management.clients create/update now accept my_organization_configuration.third_party_client_access to control whether third-party clients can access the organization.
  Client responses expose the same field.
• Connection profile Cross-App Access: management.connection_profiles create/update now accept cross_app_access_resource_app, controlling whether organization admins may enable Cross-App Access (XAA) on
  their identity providers. Connection profile responses expose the same field.
• Network ACL keys: new management.keys.network_acls client with list, create, and get for managing the keys used to verify HTTP Message Signatures on Network ACL rules. Access tokens can now be
  scoped with the new read:network_acl_keys permission.
• Network ACL rules: rules now support an optional match_all flag. When true, the rule matches all traffic unconditionally, and it is mutually exclusive with match and not_match.
• Connections: OIDC connections gain use_oauth_spec_scope - when enabled, scopes are sent space-delimited (per the OAuth 2.0 spec) instead of comma-delimited to the identity provider's authorization
  endpoint. Only relevant when using the connection_scope parameter.

Fixed

• management.forms.create / update (raw client) now surface 400/404 errors instead of an unhandled response.
• management.flows.create / update (raw client) now surface 400/409 errors instead of an unhandled response.
• management.flows.executions (raw client) now surfaces 404 errors instead of an unhandled response.
• Docstring correction in management.clients: the listed field name custom_login_page_off was corrected to custom_login_page_on.