Add group assumption for OAuth authentication

[mihaimitrea-db]

Summary

Adds group role assumption to OAuth M2M and OIDC token exchange requests. This is the second PR in the stack and is stacked on #307.

Why

#307 makes group configuration available to authentication and prevents unsupported PAT or CLI strategies from silently ignoring it. OAuth providers still need to send that group to the token endpoint; otherwise the issued token does not assume the requested role.

This PR completes the flow by sending assume_group only during OAuth token acquisition. It does not add group headers to ordinary API calls or change generated client options.

What changed

Interface changes

• Adds groupId to DatabricksOidcTokenProviderConfig.
• M2mCredentialsOptions.groupId, introduced in Add group configuration and auth validation #307, now affects OAuth M2M token grants.

Behavioral changes

• OAuth M2M token grants include assume_group for non-empty group IDs.
• OIDC token exchanges include assume_group for non-empty group IDs.
• Repeated token requests retain the configured group.
• Rejected grouped requests preserve the server error and are not retried without the group.
• Explicit credentials use only their own group configuration; profile and environment groups apply only to default credentials.
• Ordinary generated-client API requests contain the OAuth bearer token but no group-role headers.

Internal changes

• Adds focused M2M and OIDC coverage for workspace, account/unified, and account-wide endpoint shapes.
• Adds isolation, repeated-request, empty-group, and rejection tests.
• Adds a dedicated generated-client boundary test covering profile, environment, and explicit credentials.
• Adds auth documentation and changelog entries.
• Does not modify generated source files or dependencies.

How is this tested?

Passed the full repository checks:

• npm run format
• npm run lint
• npm run typecheck
• npm test
• npm run test:browser
• npm run build