Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/authorizer.go

@@ -28,8 +28,8 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam/oauth2"
+	"go.probo.inc/probo/pkg/iam/oauth2scope"
 	"go.probo.inc/probo/pkg/iam/policy"
-	"go.probo.inc/probo/pkg/iam/scopeset"
 )
 
 // AuthorizationAttributer is implemented by entities that can provide
@@ -84,21 +84,21 @@ type AuthorizeMultiParams struct {
 
 // Authorizer evaluates authorization requests against registered policies.
 type Authorizer struct {
-	pg             *pg.Client
-	evaluator      *policy.Evaluator
-	policySet      *PolicySet
-	oauth2ScopeSet *scopeset.ScopeSet
-	logger         *log.Logger
+	pg            *pg.Client
+	evaluator     *policy.Evaluator
+	policySet     *PolicySet
+	scopeRegistry *oauth2scope.Registry
+	logger        *log.Logger
 }
 
 // NewAuthorizer creates a new Authorizer instance.
-func NewAuthorizer(pgClient *pg.Client, logger *log.Logger, scopeSet *scopeset.ScopeSet) *Authorizer {
+func NewAuthorizer(pgClient *pg.Client, logger *log.Logger, scopeRegistry *oauth2scope.Registry) *Authorizer {
 	return &Authorizer{
-		pg:             pgClient,
-		evaluator:      policy.NewEvaluator(),
-		policySet:      NewPolicySet(),
-		oauth2ScopeSet: scopeSet,
-		logger:         logger,
+		pg:            pgClient,
+		evaluator:     policy.NewEvaluator(),
+		policySet:     NewPolicySet(),
+		scopeRegistry: scopeRegistry,
+		logger:        logger,
 	}
 }
 
@@ -117,7 +117,7 @@ func (a *Authorizer) checkOAuth2Scope(
 		return nil
 	}
 
-	if a.oauth2ScopeSet == nil || !a.oauth2ScopeSet.Allows(accessToken.Scopes, action) {
+	if a.scopeRegistry == nil || !a.scopeRegistry.Allows(accessToken.Scopes, action) {
 		return NewInsufficientOAuth2ScopeError(principal, action)
 	}