[AWS::BedrockAgentCore::OAuth2CredentialProvider] - [Coverage] - clientAuthenticationMethod

### Name of the resource

Other

### Resource name

AWS::BedrockAgentCore::OAuth2CredentialProvider

### Description

Problem
The clientAuthenticationMethod property is missing from the CloudFormation resource schema. The control-plane API (bedrock-agentcore-control) and CLI fully support this field with values CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, and AWS_IAM_ID_TOKEN_JWT, but the CFN resource type does not expose it.

The current CustomOauth2ProviderConfigInput schema only includes:

ClientId
ClientSecret
OauthDiscovery
OnBehalfOfTokenExchangeConfig
Notably, OnBehalfOfTokenExchangeConfig.ActorTokenContent already includes AWS_IAM_ID_TOKEN_JWT as an allowed value, indicating the schema was partially updated — but the sibling clientAuthenticationMethod field was not added.

Impact
Without this field, customers cannot declaratively provision secretless OAuth2 credential providers using AWS_IAM_ID_TOKEN_JWT client authentication. This method allows agents to authenticate to external OAuth token endpoints using their IAM execution-role identity instead of a stored client secret — eliminating secrets entirely.

This gap propagates to all IaC layers:

AWSCC Terraform provider — auto-generated from the CFN schema, inherits the gap
hashicorp/aws Terraform provider — doesn't model this resource at all yet
AWS CDK (L1 and L2, stable + alpha) — ClientSecret is required, clientAuthenticationMethod is absent
Expected Behavior
CustomOauth2ProviderConfigInput should include a ClientAuthenticationMethod property:

Type: String
Allowed values: CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT
When set to AWS_IAM_ID_TOKEN_JWT, ClientSecret should not be required
This matches the existing behavior of the bedrock-agentcore-control API and CLI (see [client authentication methods docs](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/client-auth-methods.html)).

### Other Details

_No response_

Start by reviewing the AWS::BedrockAgentCore::OAuth2CredentialProvider resource schema and the bedrock-agentcore-control API and CLI documentation linked in the issue. Confirm how CustomOauth2ProviderConfigInput represents ClientAuthenticationMethod, its allowed values, and the ClientSecret requirement; done means the CloudFormation schema exposes the field with the documented behavior.

Written by the indexing model from the issue text.