feat: add org-to-app entitlement (EA) support for organizations

[ankita10119]

🔧 Changes

Add is_app_entitlement_active and org-client associations (clients) support for organizations (Org-to-App Entitlement EA).

What changed:

• is_app_entitlement_active boolean is now exported/deployed on all organizations when the org_to_app_entitlement_enabled feature flag is enabled on the tenant
• New clients sub-resource on organizations: manages which client applications org members are entitled to use for login via use_for_member_access
• On export, client_id values are resolved to client names for portability across environments; on deploy, names are resolved back to IDs
• Create/delete operations are batched in chunks of 10 per API limits
• Gracefully handles tenants without the feature flag enabled (403 → skips silently)
• Requires read:organization_clients, create:organization_clients, update:organization_clients, delete:organization_clients scopes on the M2M application

📚 References

🔬 Testing

• Unit tests added for: export with client name resolution, create with org-clients, update (add/remove/update), remove all org-clients, and graceful 403 handling
  • Tested end-to-end against a real tenant with the org_to_app_entitlement_enabled FF enabled: export → modify org → deploy → re-export confirmed the association was applied correctly

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)