docs: highlight breaking default change for PROXY_AUTOPROVISION_CLAIM_GROUPS (OIDC group sync now opt-in)

#12490 (merged) changed the default of `PROXY_AUTOPROVISION_CLAIM_GROUPS` from `groups` to `""` (empty), disabling OIDC group-membership sync and local-group creation-from-claim by default. This is a security hardening fix (an unprivileged user on IdPs that allow self-service group creation could otherwise inject arbitrary group names into oCIS), but it is also a **behavioral break on upgrade**: any deployment that relied on the old `groups` default without setting the env var explicitly will silently stop syncing group memberships after upgrading.

The PR ships a thorough changelog entry (`changelog/unreleased/security-proxy-group-sync-opt-in.md`) explaining what/why/upgrade-path, but per the release process this default-behavior change should also be called out prominently in:
- the admin upgrade guide / release notes for the version this lands in (not just the changelog), so operators notice it before upgrading rather than after group sync silently stops
- the `PROXY_AUTOPROVISION_CLAIM_GROUPS` reference doc (auto-generated from the Go `desc` tag, already updated in the PR) — just confirm it renders as expected once published

Draft upgrade-note text (adapt to the actual release):
> **Breaking:** OIDC group membership sync is now opt-in. If you rely on `PROXY_AUTOPROVISION_ACCOUNTS=true` and want group memberships synced from an OIDC claim (previous default), set `PROXY_AUTOPROVISION_CLAIM_GROUPS=groups` (or your claim name) explicitly after upgrading.