Map ITAM actions to v1:itam OAuth2 scopes

ITAM GraphQL actions were never registered in the shared OAuth2
scope registry, so bearer-token callers failed closed even when
role policies allowed them. Add v1:itam / v1:itam:read mappings,
register them in probod, and sync the CLI client scopes.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/probod/probod.go

@@ -516,7 +516,8 @@ func (impl *Implm) Run(
 		Register(management.OAuth2ScopeMappings).
 		Register(agentrun.OAuth2ScopeMappings).
 		Register(accessreview.OAuth2ScopeMappings).
-		Register(resourcealias.OAuth2ScopeMappings)
+		Register(resourcealias.OAuth2ScopeMappings).
+		Register(itam.OAuth2ScopeMappings)
 
 	var accountKey crypto.Signer
 	if impl.cfg.CustomDomains.ACME.AccountKey != "" {