docs(organizations): roles scoped to an organization type

[devGregA]

Documents granting a role against an Organization type rather than one Organization at a time, so it applies to every Organization of that type — including Organizations created later, with nothing to backfill.

Extends the existing Organizations page rather than adding a new one. Organization Types and union-of-grants membership already ship there, so the new section cross-links those instead of restating them.

The section covers:

• what a type-scoped grant is, and the cases it exists for (compliance auditors across every regulated scope, platform teams across every Team Organization, portfolio-level reporting)
• what it does and does not do: bounded by the role's own permissions, follows the same union-of-grants rule as membership, additive-only (a grant can never reduce access), and ignores nesting, which remains reporting-only
• the deployment flag, DD_V3_ORGANIZATION_TYPE_ROLES, off by default
• why managing grants is restricted to superusers and global owners, and why grants are created and revoked rather than edited
• the note that re-typing an Organization moves it between grants' scopes

Documentation only — no code changes.