feat: tfp xaa support added

[KartikJha]

Add Cross-App Access (XAA) requesting-app support to auth0_connection

🔧 Changes

Adds support for configuring an auth0_connection as a requesting application authorization server for Cross-App Access (XAA). This is an Early Access feature that requires the token_vault_xaa flag to be enabled on the tenant, and is only supported on oidc and okta strategy connections.

• New cross_app_access_requesting_app block (schema.go): a Max: 1 block with a single required active (Boolean) attribute. It is Optional + Computed so the last-known value sticks in state. Also surfaced on the auth0_connection data source (inherited from the resource schema).
• Expand logic (expand.go): new expandConnectionCrossAppAccessRequestingApp reads the raw config and only sends the block when it has changed (data.HasChange), avoiding no-op writes. As part of this change, expandConnectionAuthentication and expandConnectionConnectedAccounts were hardened to guard against null / non-list / empty raw config before iterating.
• Flatten logic (flatten.go): new flattenConnectionCrossAppAccessRequestingApp maps the API response back into state.
• Sticky-removal behavior: removing the block from configuration is intentionally a no-op — it does not deactivate the purpose on the connection. Callers must set active = false explicitly to deactivate. Documented in the schema description, docs, and example.
• Dependency bump (go.mod): github.com/auth0/go-auth0 bumped to v1.44.1-0.20260714184021-5a0a56dc31ca to pick up the CrossAppAccessRequestingApp model.
• Docs & example: regenerated docs/resources/connection.md and docs/data-sources/connection.md; added examples/resources/auth0_connection/resource_with_oidc_xaa.tf.

📚 References

• go v1 PR

🔬 Testing

Covered by new acceptance tests (with recorded HTTP fixtures) in internal/auth0/connection/resource_test.go:

• TestAccConnectionCrossAppAccessRequestingApp — exercises the full lifecycle: create with active = true, update to active = false, an unrelated update (display_name) that preserves the sticky value, block removal confirming the last-known value stays in state, and confirming the data source inherits the field.
• TestAccConnectionCrossAppAccessRequestingAppNegative — asserts the API's operation_not_supported error passes through cleanly for unsupported (non-oidc/okta) strategies, rather than being masked or pre-validated client-side.

Recorded cassettes added: TestAccConnectionCrossAppAccessRequestingApp.yaml, TestAccConnectionCrossAppAccessRequestingAppNegative.yaml, and TestAccConnectionConnectedAccounts.yaml.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)