Add changelog for v1.38.0

[ramya18101]

Added

• Add --schema, --data, and --query flags to auth0 client-grants, auth0 actions modules, auth0 sessions update, and auth0 refresh-tokens update commands [Improve agent ergonomics for client-grants, action modules, sessions and refresh-tokens commands #1703]
• Add --schema, --data, and --query flags to auth0 email provider and auth0 phone provider commands [feat: add --schema and --data options for email and phone provider commands #1705]
• Add --reveal-secrets (-r) flag to auth0 api; client_secret and signing_keys are now masked in responses by default [fix: mask client secrets in auth0 api output unless --reveal-secrets is set #1701]

Changed

• Suggest top-level commands (e.g. auth0 client-grants create) when an unknown subcommand is used under the wrong parent [fix: suggest top-level commands for unknown subcommands #1700]
• Point agents to typed commands and auth0 client-grants from help output instead of the raw auth0 api fallback [docs: point agents to typed commands and client-grants from help #1699]
• Clarify --origins vs --web-origins in the auth0 apps create and auth0 apps update flag help [docs: clarify --origins vs --web-origins in apps flag help #1698]

Fixed

• Fix piped stdin on create/update commands to always be treated as the JSON payload; @file and - forms are now rejected with a malformed_json error pointing to --data @file [fix: reject piped file references and auth0 api paths outside /api/v2 #1697]
• Fix auth0 api to reject endpoint paths that resolve outside /api/v2, including percent-encoded dot segments, and cap AUTH0_CLI_CLIENT values at 64 characters [fix: reject piped file references and auth0 api paths outside /api/v2 #1697]