Update SSO role mapping doc: most privileged role wins on multi-match (#2495)
When an IdP attribute matches several role mappings (e.g. user belongs to
multiple groups), the assigned role is now the highest-privileged match
rather than the first match encountered.
Co-authored-by: huggingface-doc-bot <doc-bot@huggingface.co>