docs: update SSO role mapping (most privileged role wins on multi-match)

[Charlie-Boyer]

Problem

The SSO doc still says the first matching mapping wins when an IdP attribute matches several role mappings.

Fix

Update the doc to reflect the new behavior introduced in huggingface-internal/moon-landing#18282: the most privileged matching role is assigned, with hierarchy read < contributor < write < admin.

---

Note

Low Risk
Documentation-only change that updates described SSO role-mapping precedence; no runtime behavior or security logic is modified.

Overview
Updates security-sso-user-management.md to reflect that when an IdP attribute contains multiple values matching multiple role mappings, the assigned org role is now the most privileged match (with explicit hierarchy read < contributor < write < admin) rather than the first match.

^{Reviewed by Cursor Bugbot for commit 7ac0a64. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[Pierrci]

thanks for taking care of that!