Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/errors.go

@@ -203,6 +203,23 @@ func (e ErrInsufficientPermissions) Error() string {
 	return fmt.Sprintf("identity %q does not have sufficient permissions to perform action %s on entity %q", e.IdentityID, e.Action, e.EntityID)
 }
 
+type ErrInsufficientOAuth2Scope struct {
+	IdentityID gid.GID
+	Action     Action
+}
+
+func NewInsufficientOAuth2ScopeError(identityID gid.GID, action Action) error {
+	return &ErrInsufficientOAuth2Scope{IdentityID: identityID, Action: action}
+}
+
+func (e ErrInsufficientOAuth2Scope) Error() string {
+	return fmt.Sprintf(
+		"identity %q does not have an OAuth2 scope granting action %s",
+		e.IdentityID,
+		e.Action,
+	)
+}
+
 type ErrMixedOrganizationBatch struct {
 	Action          Action
 	OrganizationIDs []string