Docs: additional explanation for "protect all flows"

[bhaugeea]

Mainly adds additional explanation of post login flows, which are not unique to this extension but highly relevant. This additional information would be helpful for new/prospective users like me. Keycloak's own documentation seems to lack a searchable explanation about how brokering bypasses subsequent authentication flow steps, and not only allows but really requires explicit post login flows.

[leona-ya]

I would also add that the registration and reset credentials flow are affected. These are really simple to exploit, so we should mention them explicitly. It's really not very clear that they don't just use the browser flow.

[sventorben]

Thanks for the contribution.