Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/files/v1/handler.go

@@ -157,7 +157,18 @@ func (h *Handler) handleGetFile(w http.ResponseWriter, r *http.Request) {
 
 	scope, err := h.iamSvc.Authorizer.Authorize(ctx, params)
 	if err != nil {
+		if _, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
+			jsonx.RenderForbidden(w)
+			return
+		}
+
+		if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok {
+			jsonx.RenderForbidden(w)
+			return
+		}
+
 		jsonx.RenderNotFound(w, fmt.Errorf("file not found"))
+
 		return
 	}