Expose authType on SecurityPolicy.oidc for the token-exchange request

Envoy's OAuth2 filter accepts `auth_type: URL_ENCODED_BODY | BASIC_AUTH` to control whether `client_id` / `client_secret` are sent in the form body or as HTTP Basic Auth. Envoy Gateway's OIDC translator hardcodes `BASIC_AUTH`, with no `SecurityPolicy` field to override.

Some OIDC providers — WorkOS AuthKit being the case I hit — only read `client_id` from the form body and ignore the `Authorization` header, so the token-exchange step fails with:

```
{"error":"invalid_request","error_description":"Missing required parameter: client_id."}
```

**Ask**: add an optional `authType` field to `SecurityPolicy.oidc`, enum `{UrlEncodedBody, BasicAuth}`, defaulting to `BasicAuth` to preserve current behavior.

**Current workaround**: an `EnvoyPatchPolicy` JSON-patching the listener's OAuth2 filter to flip `auth_type` to `URL_ENCODED_BODY`. Works but brittle — it encodes the listener name and the filter ordinal, so any translator-output change breaks it silently.