feat!: add client profiles, captcha policies, client search, and dynamic CIMD settings

[fern-api]

Adds client profiles, CAPTCHA policies, client and client grant search, and dynamic CIMD support to the Management API client, and exposes every generated resource on ManagementClient.

Breaking Changes ⚠️

The breaking changes are limited to the experimentation APIs, one field on organization search results, a connection model that no endpoint returns, and one error mapping.

• Experiments and feature flags: experiments.update_status() and feature_flags.update_status() are removed. A separate status endpoint is no longer needed, because the status is now set through the update request: client.experimentation.experiments.update(id, status=...) and client.experimentation.feature_flags.update(id, status=...).
• SearchOrganization: the metadata field is removed.
• ConnectionResponseCommon: now declares its own fields instead of extending CreateConnectionCommon, and display_name is required. No endpoint returns this model, so no client call is affected.
• Feature flag variations: variations.delete() no longer maps HTTP 400 to BadRequestError, so a 400 raises the base ApiError. Code that catches ApiError is unaffected.

Added

• Full resource access on ManagementClient: every Management API resource is now available on the client, including agents, client_profiles, connection_profiles, events, experimentation, groups, rate_limit_policies, risk_assessments, and user_attribute_profiles.
• Client Profiles: define a configuration that applies automatically to every client matching a rule, and manage it through client.client_profiles.
• CAPTCHA Policies: create and manage CAPTCHA policies through client.attack_protection.captcha_policies.
• Search for clients and client grants: find applications and grants with client.clients.search() and client.client_grants.search(), with pagination and sorting.
• Dynamic CIMD registration: turn on dynamic registration for Client ID Metadata Document clients in tenant settings, and see each client's metadata status.
• New settings:
  • Clients: enforce_anon_session_transfer_network_binding and oidc_support
  • Tenant settings: dpop_strict_refresh_token_binding
  • Brute force protection: form_submission_mode
  • Experiments, feature flags, and segments: status
• Smaller additions: Google Workspace provisioning and directory sync on connection profiles, an organization member access level on organization connection events, and the passkey Guardian factor.

Changed

• CIMD Registration: client.clients.register_cimd_client() raises ConflictError on HTTP 409 instead of ApiError. ConflictError subclasses ApiError, so existing handlers still catch it.
• Roles: owner_id on the roles.list() filter is typed as RoleOwnerIdFilter, and owner_id on the role response types as RoleOwnerId, with SystemRoleOwnerId added. All three are string aliases, so existing code is unaffected.
• Event stream cloud events: a0stream is now optional on the connection, group, organization, and user cloud event types. It is omitted when events are retrieved through the Events API.

Removed

• experiments.update_status() and UpdateExperimentStatusResponseContent. Use experiments.update(id, status=...).
• feature_flags.update_status() and UpdateFeatureFlagStatusResponseContent. Use feature_flags.update(id, status=...).
• SearchOrganization.metadata.

[rmad17]

LGTM!