Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/authorizer_decisionlog_test.go

@@ -29,8 +29,8 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/iam/oauth2scope"
 	"go.probo.inc/probo/pkg/iam/policy"
-	"go.probo.inc/probo/pkg/iam/scopeset"
 )
 
 func TestAuthorizer_DecisionLogging(t *testing.T) {
@@ -152,7 +152,7 @@ func newTestAuthorizerWithLogger(
 
 	statements = append(statements, extraStatements...)
 
-	authorizer := iam.NewAuthorizer(client, log.NewLogger(log.WithOutput(logOutput)), scopeset.New())
+	authorizer := iam.NewAuthorizer(client, log.NewLogger(log.WithOutput(logOutput)), oauth2scope.NewRegistry())
 	authorizer.RegisterPolicySet(
 		iam.NewPolicySet().AddRolePolicy(
 			string(coredata.MembershipRoleOwner),