feat: sync beta to v3 (v3.0.0 + v3.1.0 stable content) and add B2B integration config

[developerkunal]

🔧 Changes

Brings the beta branch up from v2.15.0-beta.0 to the v3 line, carrying the full stable v3.0.0 and v3.1.0 content on the new module path, plus one beta-specific addition. Beta's existing endpoints are unchanged; the Experimentation API (shipped in v2.14.0-beta.0) only moves import paths here.

Module path (breaking)

• BREAKING: module path changed from github.com/auth0/go-auth0/v2 to github.com/auth0/go-auth0/v3. Every import is updated and go.mod dependencies are refreshed.

v3.0.0 stable highlights (mirrored from main)

Breaking changes:

• Removed the Users.FederatedConnectionsTokensets sub-client (List, Delete) and the FederatedConnectionTokenSet type.
• Removed the ConnectionFederatedConnectionsAccessTokens type and the FederatedConnectionsAccessTokens field from ConnectionPropertiesOptions, UpdateConnectionOptions, ConnectionOptionsAzureAd, and ConnectionOptionsCommonOidc.
• Removed the asn value from ClientSessionTransferDelegationDeviceBindingEnum (only ip remains).
• Changed ListRolesOffsetPaginatedResponseContent Start/Limit/Total from *float64 to float64 (setter signatures change).
• Replaced the shared ConnectionAttributeIdentifier with per-attribute EmailAttributeIdentifier, PhoneAttributeIdentifier, and UsernameAttributeIdentifier types.
• Replaced PhoneProviderProtectionBackoffStrategyEnumNone ("none") with ...EnumDefault ("default").

Added:

• Organization role members endpoint (Organizations.Roles.Members.List) with cursor pagination.
• Organization third-party client access (ThirdPartyClientAccess / OrganizationThirdPartyClientAccessEnum).
• OrganizationID on UserGrant.
• Token vault privileged access Grants and the TokenVaultPrivilegedAccessGrant type.
• Connection OIDC discovery (DiscoveryURL, OidcMetadata, ConnectionsOidcMetadata).
• DefaultMethodPhoneNumberIdentifierEnum (password, phone_otp).
• Connection event stream events (connection.created/deleted/updated) with their CloudEvent enums.
• Auth0Managed on NetworkACLMatch, confirmation on PartialGroupsEnum, and the NotFoundErrorBody / TooManyRequestsErrorBody types.

v3.1.0 stable highlights (mirrored from main)

• Connection cross-app access resource app (CrossAppAccessResourceApp field with create/update/response types and status enums).
• Client identity assertion authorization grant (IdentityAssertionAuthorizationGrant).
• Self-service profile ThirdPartyClientAccessConfig on the SSO ticket request.
• Branding theme Identifiers (BrandingThemeIdentifiers) with login/phone display enums.
• Session Actor (SessionActorMetadata, SessionActorClaimValue union).
• SuspiciousIPThrottlingPreCustomTokenExchangeStage.

Beta-specific (new here, not on stable)

• B2B integration configuration: a b2b_integration_configuration field on the client and client create/update requests, backed by the B2BIntegrationConfiguration type (holds sso_profiles, max one SSO profile ID). This is the only type introduced in this change that is not already on beta or stable.

Docs and release tooling

• Restores the beta-track docs dropped when the v3 docs were pulled in and makes the version examples v3-coherent: README re-adds the Beta SDK opt-in section on /v3; CONTRIBUTING and AGENTS fix the beta install/versioning examples.
• compute-next-version now derives the major from the go.mod module path instead of a hardcoded v2 regex, so a future major bump needs no change.
• Stable CI updates from main (pinned action version bumps) are carried in as part of the sync.

.version, meta.go, and CHANGELOG.md are intentionally left untouched so the beta auto-release workflow stamps them on merge.

📚 References

None

🔬 Testing

go build ./... and go vet ./... both pass. compute-next-version was validated against the live tags: it resolves major v3 from go.mod and computes v3.2.0-beta.0 as the next beta.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)