docs: resource group auto-join scope

[alexpouliquen]

This PR document the new resource group auto-join scope option.

---

Note

Low Risk
Documentation-only updates with no runtime, API, or security behavior changes in this PR.

Overview
Documents the new resource group auto-join scope so admins can limit automatic membership instead of always including every org member.

security-resource-groups.md adds an Auto-join scope section (all vs Read+ members only, excluding no_access), renames the UI control to Auto-include org members, and updates backfill/SCIM wording to refer to scoped members rather than “every” member.

programmatic-user-access-control.md documents the optional autoJoin.scope field ("all" or "read_plus", default "all") in the settings API example and body reference, and aligns backfill language with the chosen scope.

^{Reviewed by Cursor Bugbot for commit a85582e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[Pierrci]

nice, thanks!