feat: add support for Keys Network ACLs, 3P client access, XAA connection profiles and nullable response fields now OptionalNullable

[fern-api]

Changes

New API surface

• Keys Network ACLs - new keys().networkAcls() client with list(), create(), and get(id) against /keys/network-acls, plus NetworkAclKey, NetworkAclKeyAlgorithmEnum, CreateKeysNetworkAclsRequestContent / ResponseContent, and GetAllKeysNetworkAclsResponseContent. New OauthScope constants: read:network_acl_keys and create:network_acl_keys.
• Connection profile cross-app access - ConnectionProfile.crossAppAccessResourceApp with ConnectionProfileCrossAppAccessResourceApp and status enums.
• Third-party client access - thirdPartyClientAccess on the ClientMyOrganization response/patch/post configurations, with allowed-values and default-value enums.
• Connection options - useOauthSpecScope on ConnectionOptionsOidc, ConnectionOptionsCommonOidc, ConnectionOptionsOkta, ConnectionPropertiesOptions, and UpdateConnectionOptions.
• Network ACL rules - matchAll on NetworkAclRule.

📢 Nullability model change (breaking for readers)

Date and nullable fields on sessions, refresh tokens, and flow action params move from Optional<T> to OptionalNullable<T>, so the SDK can distinguish "absent" from "explicit null":

• GetSessionResponseContent / SessionResponseContent / UpdateSessionResponseContent: created_at, updated_at, authenticated_at, idle_expires_at, expires_at, last_interacted_at
• GetRefreshTokenResponseContent / RefreshTokenResponseContent / UpdateRefreshTokenResponseContent: created_at, idle_expires_at, expires_at, last_exchanged_at
• SessionAuthenticationSignal: timestamp
• FlowActionFlowMapValueParams: fallback

Callers reading these fields need .toOptional() to restore the previous Optional<T> API:

// before
Optional<SessionDate> created = session.getCreatedAt();
// after
Optional<SessionDate> created = session.getCreatedAt().toOptional();

Builder setters retain Optional<T> overloads, so write paths are unaffected.

Error handling

• RawFlowsClient: added 409 ConflictError and 400 BadRequestError branches.
• RawFormsClient: added 400 BadRequestError and 404 NotFoundError branches.

References

Generated from the Auth0 API definition.

Testing

• ./gradlew assemble check passes locally.
• New generated KeysNetworkAclsWireTest covers list / create / get.
• Wire-test fixtures updated for third_party_client_access, cross_app_access_resource_app, and match_all.

Checklist

• All new/changed code is covered by generated tests
• All active GitHub CI checks pass
• Breaking change — read-path signature change on 32 getters across 8 types. Needs a version-bump decision and a v4_MIGRATION_GUIDE.md entry before merge.