docs(sso): note OIDC client_secret_post token endpoint auth method

[Charlie-Boyer]

Document that Hugging Face authenticates to the IdP token endpoint using client_secret_post by default, and that IdP apps expecting a different method fail with invalid_client. Helps customers resolve OIDC SSO login failures on the IdP side.

---

Note

Low Risk
Documentation-only change with no runtime or security logic impact.

Overview
Adds a TIP callout to the SSO configuration guides index explaining that Hugging Face uses client_secret_post when calling the IdP token endpoint during the authorization code exchange.

It notes that IdP apps set to another method (e.g. client_secret_basic) can fail with invalid_client, and directs admins to set token endpoint authentication to client_secret_post on the IdP side.

^{Reviewed by Cursor Bugbot for commit 9a9c4d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.