fix(gateway): Document what clients receive when OIDC token exchange fails

[Brisinger]

Clarify behavior on token exchange failure and logging.

Description

Fixes #7529

Adds one paragraph to "How token exchange works": a failed exchange (token endpoint refusal, 5xx, or unreachable) returns 401 with error="invalid_token" to the client, the token endpoint status is only in the data plane log, and an unreachable endpoint answers after config.timeout.

Observed on Kong Gateway Enterprise 3.14.0.15, self-managed data plane, four runs; the full table is in the issue. The paragraph says "about twice config.timeout (measured; see #7529)" because, when the token endpoint didn't answer, Kong sent a second token request (details and a question in the issue). Please confirm the behaviour on 3.15 and 3.16 before merging. If it differs by version, the paragraph may need a version note.

Preview Links

https://deploy-preview-7531--kongdeveloper.netlify.app/plugins/openid-connect/#token-exchange

Checklist

• Tested how-to docs. If not, note why here. Not applicable: reference page, no how-to changed.
• All pages contain metadata. (Frontmatter unchanged.)
• Any new docs link to existing docs. (Links to the config.timeout reference.)
• All autogenerated instructions render correctly (API, decK, Konnect, Kong Manager). Not applicable: no instructions changed.
• Style guide (capitalized gateway entities, placeholder URLs) implemented correctly.
• Every page has a description entry in frontmatter. (Unchanged.)
• Add new pages to the product documentation index (if applicable). Not applicable.

[netlify]

👷 Deploy request for kongdeveloper pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	e93384a