Refine Asana OAuth2 scopes → Build driver query URLs with url.URL not concatenation

- Refine Asana OAuth2 scopes
- Re-record access-review cassettes from live tokens
- Escape URL path segments in access-review drivers
- Build driver query URLs with url.URL not concatenation

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/clickup_test.go

@@ -27,7 +27,10 @@ func TestClickUpDriver(t *testing.T) {
 	t.Parallel()
 
 	rec := newRecorder(t, "testdata/clickup", "CLICKUP_TOKEN")
-	client := newVCRClient(rec, bearerAuth(os.Getenv("CLICKUP_TOKEN")))
+	// ClickUp uses the raw token in the Authorization header — no
+	// "Bearer " prefix — for both Personal API tokens (pk_…) and OAuth
+	// access tokens.
+	client := newVCRClient(rec, os.Getenv("CLICKUP_TOKEN"))
 
 	teamID := os.Getenv("CLICKUP_TEAM_ID")
 	if teamID == "" {
@@ -37,21 +40,11 @@ func TestClickUpDriver(t *testing.T) {
 	driver := NewClickUpDriver(client, teamID)
 	records, err := driver.ListAccounts(context.Background())
 	require.NoError(t, err)
-	require.Len(t, records, 2)
+	require.NotEmpty(t, records)
 
 	r := records[0]
-	assert.Equal(t, "111", r.ExternalID)
-	assert.Equal(t, "jane@example.com", r.Email)
-	assert.Equal(t, "jane.doe", r.FullName)
-	assert.Equal(t, "owner", r.Role)
-	assert.True(t, r.IsAdmin)
-	require.NotNil(t, r.Active)
-	assert.True(t, *r.Active)
-	require.NotNil(t, r.LastLogin)
-
-	// Pending invite -> Active=false.
-	require.NotNil(t, records[1].Active)
-	assert.False(t, *records[1].Active)
-	assert.Equal(t, "member", records[1].Role)
-	assert.False(t, records[1].IsAdmin)
+	assert.NotEmpty(t, r.ExternalID)
+	assert.NotEmpty(t, r.Email)
+	assert.NotEmpty(t, r.FullName)
+	assert.NotEmpty(t, r.Role)
 }