Create a WorkOS machine-to-machine app. The server generates the app name. If neither access nor the deprecated roles field is supplied, access defaults to all.read with unrestricted security-group access. The plaintext client secret is returned only in this response.