Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/mcp/v1/resolver.go

@@ -82,6 +82,10 @@ func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.A
 		return nil, fmt.Errorf("permission denied")
 	}
 
+	if _, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
+		return nil, fmt.Errorf("insufficient scope")
+	}
+
 	if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok {
 		return nil, fmt.Errorf("assumption required")
 	}
@@ -114,6 +118,10 @@ func (r *Resolver) AuthorizeBatch(ctx context.Context, entityIDs []gid.GID, acti
 		return nil, fmt.Errorf("permission denied")
 	}
 
+	if _, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
+		return nil, fmt.Errorf("insufficient scope")
+	}
+
 	if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok {
 		return nil, fmt.Errorf("assumption required")
 	}