feat: add Organization Role Members, thirdPartyClientAccess, optional fields and contains breaking changes

[fern-api]

Summary

Adds the Organization Role Members API and a full Connection event-stream family, plus several new optional fields. Includes three breaking changes that require a major version bump.

New Features

• Organization Role Members API — new client tree
  client.organizations().roles().members().list(orgId, roleId) returning
  SyncPagingIterable<RoleMember> (+ async, raw, and RequestOptions overloads).
  New types: RoleMember, ListOrganizationRoleMembersRequestParameters,
  ListOrganizationRoleMembersResponseContent.
• New types: TokenVaultPrivilegedAccessGrant, ConnectionsOidcMetadata,
  OrganizationThirdPartyClientAccessEnum.

Minor / Backward-compatible Changes

• New optional thirdPartyClientAccess on Organization and the
  Create/Update/Get Organization request & response types.
• New optional identifier on EmailAttribute, PhoneAttribute, UsernameAttribute.
• New optional organizationId on UserGrant.
• New nullable discoveryUrl and oidcMetadata on UpdateConnectionOptions and
  ConnectionPropertiesOptions.
• PartialGroupsEnum: added CONFIRMATION.

⚠️ Breaking changes

1. Role pagination fields are now non-optional primitives. In ListRolesOffsetPaginatedResponseContent, start, limit, and total change from Optional<Double> to primitive double, and are
   now required builder stages.

   // Before
   private final Optional<Double> start;
   public Optional<Double> getStart() { ... }
   
   // After
   private final double start;
   public double getStart() { ... }
   
   Callers reading these getters (previously Optional<Double>) or building the type must update. The builder now requires start / limit / total as staged, mandatory double arguments.
   

2. Connection attribute identifier is split by attribute type. The shared ConnectionAttributeIdentifier type is removed and replaced with dedicated EmailAttributeIdentifier, PhoneAttributeIdentifier,
   and UsernameAttributeIdentifier types. The identifier field on EmailAttribute, PhoneAttribute, and UsernameAttribute changes type accordingly, and their getIdentifier() / builder identifier(...) signatures change.

   // Before
   public Optional<ConnectionAttributeIdentifier> getIdentifier() { ... }
   
   // After (EmailAttribute)
   public Optional<EmailAttributeIdentifier> getIdentifier() { ... }

3. Phone provider protection backoff strategy enum value changed. PhoneProviderProtectionBackoffStrategyEnum.NONE ("none", visitNone()) is removed and replaced by
   PhoneProviderProtectionBackoffStrategyEnum.DEFAULT ("default", visitDefault()).

Test Plan

• mvn verify passes
• New OrganizationsRolesMembersWireTest passes
• Updated Organizations / EventStreams / Clients wire tests pass