Map ITAM actions to v1:itam OAuth2 scopes

ITAM GraphQL actions were never registered in the shared OAuth2
scope registry, so bearer-token callers failed closed even when
role policies allowed them. Add v1:itam / v1:itam:read mappings,
register them in probod, and sync the CLI client scopes.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/cli/config/config.go

@@ -54,6 +54,7 @@ const (
 		"v1:datum " +
 		"v1:document " +
 		"v1:iam " +
+		"v1:itam " +
 		"v1:org " +
 		"v1:privacy " +
 		"v1:risk " +