KAFKA-18608: Add documentation for OAuth client assertion authentication (KIP-1258)

[prabhashkr]

• Add documentation for client assertion authentication support in the client_credentials grant type, introduced in https://cwiki.apache.org/confluence/display/KAFKA/KIP-1258 / PR KAFKA-18608: Add Support for OAuth Client Assertion to client_credentials Grant Type #21483
• Document the three-tier fallback mechanism (file-based assertion > locally-generated assertion > client secret)
• Add configuration examples for dynamically-generated assertions, pre-generated assertion files, and assertion template files
• Clarify that DefaultJwtRetriever auto-delegates to ClientCredentialsJwtRetriever for HTTP/HTTPS endpoints, so sasl.oauthbearer.jwt.retriever.class does not need to be set explicitly in most cases
• Update "Secure/Production Use" section to reference built-in JWT retriever implementations
• Add security considerations for client assertion (replay protection via JTI, short-lived assertions)