Add OAuth2 Client ID Metadata Document support

MCP connectors such as ChatGPT and Claude register via HTTPS
client_id URLs instead of pre-provisioned GIDs. Fetch and cache
their metadata documents, upsert clients on first use, and
advertise CIMD in OIDC discovery when allowed URLs are configured.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/service.go

@@ -200,7 +200,10 @@ func NewService(
 		cfg.OAuth2ServerSigningKeys,
 		uri.URI(cfg.BaseURL.String()),
 		cfg.Logger.Named("oauth2"),
-		cfg.OAuth2ServerOptions...,
+		append(
+			[]oauth2.Option{oauth2.WithAPIScopes(svc.Authorizer.APIScopes())},
+			cfg.OAuth2ServerOptions...,
+		)...,
 	)
 
 	svc.samlDomainVerifier = NewSAMLDomainVerifier(