Docs on client_credentials grant support

[Cantor, Scott]

The OP plugin docs are updated with most of (my) new additions, primarily the new client authentication changes [1] and the client_credentials/JWT support [2].

With reagard to the latter, about the only config question I'm chewing on is whether JWT encryption should be optional by default, or require manually allowing. OIDC leaves it optional by default but that was a) maybe not a super choice but b) kind of defensible because the tokens are meant only for the client and usually pulled over TLS).

This grant is not at all like that, so any custom claims would be exposed to the client that really doesn't need to see them, and potentially exposed over other insecure channels out of the OP's control. Our usual practice is to encrypt by default and require intervention to make that optional, so I changed the default to follow that, but it does mean the support for unverified/unregistered resource servers always has an extra step of applying that setting change too, which is a little awkward.

-- Scott

[1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930409507/OPClientAuthentication
[2] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930606124/OPClientCredentialsGrant