Authenticate SharePoint Online connectors with certificate-based JWT assertions (Microsoft Entra)

## Summary

PR #268847 adds a new auth type, `oauth_client_credentials_private_key_jwt`, to the SharePoint Online connector in Connectors V2. Instead of a shared client secret, the connector signs a short-lived PS256 JWT client assertion (using a certificate and private key with an `x5t#S256` thumbprint, per Microsoft's Entra specification) and exchanges it at the token endpoint. This is Microsoft's recommended approach for app-only access to Microsoft Graph and SharePoint Online in production environments. The in-repo docs file was updated in this PR to describe the new 'OAuth Client Certificate (Microsoft Entra)' auth type, including connector configuration fields and setup steps, but these changes will only appear in published docs starting from 9.5.0.

**Why this needs docs:** The PR modifies the SharePoint Online connector docs page to add a third auth type; the published docs page currently describes only two auth types (client credentials with client secret and delegated auth), so users on 9.5.0 and serverless will encounter a UI option not yet covered in the published documentation.

## Resources

- PR [#268847](https://github.com/elastic/kibana/pull/268847) — [Agent Builder] Add jwt-assertion-based client credentials auth type for connectors-v2

Screenshots from PR


## Availability

| Channel | Details |
|---------|---------|
| **Stack** | v9.5.0 |
| **Serverless** | May 25–May 29 |
| **Feature flag** | None — active by default |

---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @nastasha-solomon*

## Suggested edits

[SharePoint Online connector](https://www.elastic.co/docs/reference/connectors-kibana/sharepoint-online-action-type) > Connector configuration
- **What the docs say:** SharePoint Online connectors support two authentication methods: OAuth client credentials (app-only auth) using a client secret, and OAuth authorization code (delegated auth).
- **What to add:** Add a third authentication type — 'OAuth Client Certificate (Microsoft Entra) — app-only auth' — which uses a PS256-signed JWT client assertion with an `x5t#S256` certificate thumbprint instead of a client secret. Document the required connector fields (Token URL, Client ID, Certificate, Private Key, and optional Passphrase) and note that this is Microsoft's recommended method for app-only production access to Microsoft Graph and SharePoint Online. Applies from 9.5.0 and in serverless.

[SharePoint Online connector](https://www.elastic.co/docs/reference/connectors-kibana/sharepoint-online-action-type) > Get API credentials
- **What the docs say:** The 'Get API credentials' section describes setup steps for 'OAuth client credentials (app-only auth)' using a client secret and 'OAuth authorization code (delegated auth)'. There is no section covering certificate-based authentication.
- **What to add:** Add a new 'OAuth Client Certificate (Microsoft Entra) — recommended for production' subsection under 'Get API credentials'. Include steps to register a Microsoft Entra app, assign `Sites.Selected` and `Files.Read.All` application permissions, generate a self-signed X.509 certificate with OpenSSL, upload the public certificate under Certificates & secrets, and provide Token URL, Client ID, Certificate, Private Key, and Passphrase values in Kibana. Clarify that this method uses a short-lived JWT assertion signed with the private key and bound to the uploaded certificate (not TLS mutual authentication), making it more secure than client secrets because no long-lived shared secret is transmitted. Applies from 9.5.0 and in serverless.