Client secret disclosure via nested provider serialization

Incorrect authorization in authentik before 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 allows remote authenticated users to read client secrets. The access-token list serializer embeds a provider object containing client_id and client_secret instead of omitting confidential provider credentials from low-privilege API responses. Exploitation requires a non-admin account with at least one access token from a completed OAuth2 flow, and disclosure is limited to confidential providers previously used by that account.