clarify org-scoped oauth token access

[Pierrci]

companion of https://github.com/huggingface-internal/moon-landing/pull/17824

Note

Low Risk
Low risk documentation-only change clarifying what organization-scoped Token Exchange tokens can and cannot access outside the org.

Overview
Clarifies the security restrictions for Token Exchange “organization-scoped” tokens by explicitly stating that they also cover org-owned collections, and that out-of-org access is limited to read-only public collections plus individually granted public gated repos.

^{Reviewed by Cursor Bugbot for commit 2108eda. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.