This reverts commit 607da43.

Resets the main branch (`master`) to have the same changeset as 2.184.0
but under 2.185.0.

Original release please notes:


### Features

* Add Sb-Forwarded-For header and IP-based rate limiting
([#2295](#2295))
([e8f679b](e8f679b))
* allow amr claim to be array of strings or objects
([#2274](#2274))
([607da43](607da43))
* Treat rate limit header value as comma-separated list
([#2282](#2282))
([5f2e279](5f2e279))


### Bug Fixes

* check each type independently
([#2290](#2290))
([d9de0af](d9de0af))
* fix the wrong error return value
([#1950](#1950))
([e2dfb5d](e2dfb5d))
* **indexworker:** remove pg_trgm extension
([#2301](#2301))
([c553b10](c553b10))
* **oauth-server:** allow custom URI schemes in client redirect URIs
([#2298](#2298))
([ea72f57](ea72f57))
* tighten email validation rules
([#2304](#2304))
([33bb372](33bb372))

---------

Co-authored-by: depthfirst-app[bot] <184448029+depthfirst-app[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop*
---


##
[2.185.0](v2.184.0...v2.185.0)
(2026-01-12)


### Features

* Add Sb-Forwarded-For header and IP-based rate limiting
([#2295](#2295))
([e8f679b](e8f679b))
* allow amr claim to be array of strings or objects
([#2274](#2274))
([607da43](607da43))
* reset main branch to 2.185.0
([#2325](#2325))
([b9d0500](b9d0500))
* Treat rate limit header value as comma-separated list
([#2282](#2282))
([5f2e279](5f2e279))


### Bug Fixes

* additional provider and issuer checks
([#2326](#2326))
([cb79a74](cb79a74))
* check each type independently
([#2290](#2290))
([d9de0af](d9de0af))
* fix the wrong error return value
([#1950](#1950))
([e2dfb5d](e2dfb5d))
* **indexworker:** remove pg_trgm extension
([#2301](#2301))
([c553b10](c553b10))
* **oauth-server:** allow custom URI schemes in client redirect URIs
([#2298](#2298))
([ea72f57](ea72f57))
* tighten email validation rules
([#2304](#2304))
([33bb372](33bb372))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Summary

This PR loosens the validation for the `amr` (Authentication Method
Reference) claim in custom access token hooks to accept both array of
strings and array of objects, instead of only array of objects.

- **Test Coverage**: Added two new test cases:
- Modify amr to be array of strings - Verifies that `amr` as an array of
strings passes validation
- Modify amr to be array of objects - Verifies that `amr` as an array of
objects still works (backward compatibility)

## Motivation

This change provides more flexibility for custom access token hooks.
[RFC-8176
](https://www.rfc-editor.org/rfc/rfc8176.html#section-1)requires `amr`
to be array of strings.

## Testing

All tests pass, including:
- Existing custom access token tests
- New test for `amr` as array of strings
- New test for `amr` as array of objects

## Backward Compatibility

**Fully backward compatible** - The change only adds support for an
additional format. Existing hooks that return `amr` as an array of
objects will continue to work without any changes.