Fix stale UI labels across admin and how-to docs

[mindymo]

Corrects bolded UI label text in product docs to match current frontend strings. Found via a full /check-ui-labels audit across all of product/ (663 flagged labels reviewed, false positives filtered out).

Changes

• Download to CSV → Download as CSV: applications.mdx, managing-accounts.mdx, managing-entitlements.mdx, managing-resources.mdx
• "+ New request" / "+ Add X" → "New request" / "Add X": the "+" is a rendered icon, not part of the label — customize-requests.mdx, qs-self-service-requests.mdx, request-actions.mdx, create-requests.mdx, campaigns.mdx, automations.mdx, role-mining.mdx
• campaigns.mdx: Grant types → Grant type, Account parameters → Account selection, Grant parameters → Grant selection
• Test CEL → Test expression: custom-oidc.mdx, federation-setup.mdx
• Client credential grant → Client credentials: service-principals/security.mdx
• OAuth2 mode labels (dropped the "OAuth2 —" prefix / added RFC number to match the actual dropdown): mcp-servers.mdx, mcp-server/looker.mdx, mcp-server/wiz.mdx, mcp-server/google-analytics-admin.mdx, mcp-server/google-drive.mdx
• policies.mdx: Add another rule → Add rule
• secret-sharing.mdx: Reveal content → Reveal secret
• tool-call-hooks.mdx: Add hook → New hook
• tools-and-toolsets.mdx: Add toolset → Create toolset, All approved tools → All approved, All read tools → Read-only
• provisioning.mdx: Ticket-based provisioning → External ticketing (heading + body)
• enable-ai-access-management.mdx: AI clients → MCP clients, Emergency kill switch/Disable all AI access → Disable system features/Disable MCP traffic
• qs-on-call-access-control.mdx: Auto approval → Auto-approve
• step-up-auth.mdx: OAuth2 (RFC 9470 compliant) → OAuth2, "Requires Step Up Authentication"/"Approve with Step Up" runtime text → "(step-up required)" suffix

Out of scope for this PR (left for manual review — need a judgment call, not a mechanical rename):

• release-notes.mdx (historical record, same as release-notes-archive.mdx)
• Whole-page "AI client" → "MCP client" terminology in ai-clients.mdx / audit-ai-tool-usage.mdx (affects the page title, not just a button label)
• A larger set of "Investigate" findings (stale "AI > C1 Gateway" nav paths across ~9 files, several roles/labels that may no longer exist, a few connector-schema-driven strings) reported separately for follow-up

Test plan

• Each replacement label confirmed against defaultMessage/component text in c1/frontend (see PR description above for source files, available on request)
• Spot-check a few pages in the live app to confirm exact casing/punctuation