Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/oauth2/cimd.go

@@ -400,15 +400,7 @@ func (s *Service) upsertCIMDClient(
 		clientURI = &doc.ClientURI
 	}
 
-	scopes := slices.Concat(
-		[]coredata.OAuth2Scope{
-			ScopeOpenID,
-			ScopeProfile,
-			ScopeEmail,
-			ScopeOfflineAccess,
-		},
-		s.scopeSet.APIScopes(),
-	)
+	scopes := coredata.OAuth2Scopes(authorizationServerScopes(s.registry.RegisteredScopes()))
 
 	now := time.Now()