update JWT realm docs to include at+jwt support

Author: richard-dennehy

docs/reference/security/authentication/jwt-realm.asciidoc

@@ -294,7 +294,7 @@ token.
 as `HS256`. The algorithm must be in the realm's allow list.
 
 `typ`::
-(Optional, String) Indicates the token type, which must be `JWT`.
+(Optional, String) Indicates the token type. For an ID token, this must be `JWT`; for access tokens, this must be `JWT` or `at+jwt`.
 
 [[jwt-validation-payload]]
 ===== Payload claims