Add note on iap client that only internal org clients can be created (#3609) (#2148)

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

.changelog/3609.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

website/docs/r/iap_client.html.markdown

@@ -24,6 +24,10 @@ description: |-
 
 Contains the data that describes an Identity Aware Proxy owned client.
 
+~> **Note:** Only internal org clients can be created via declarative tools. Other types of clients must be
+manually created via the GCP console. This restriction is due to the existing APIs and not lack of support
+in this tool.
+
 
 
 ~> **Warning:** All arguments including `secret` will be stored in the raw