Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/oauth2/metadata.go

@@ -15,8 +15,6 @@
 package oauth2
 
 import (
-	"slices"
-
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/uri"
 )
@@ -61,7 +59,7 @@ type (
 	}
 )
 
-func NewMetadata(issuer uri.URI, endpoints Endpoints, apiScopes []coredata.OAuth2Scope) *ServerMetadata {
+func NewMetadata(issuer uri.URI, endpoints Endpoints, registeredScopes []coredata.OAuth2Scope) *ServerMetadata {
 	return &ServerMetadata{
 		Issuer:                      issuer,
 		AuthorizationEndpoint:       endpoints.Authorization,
@@ -72,16 +70,8 @@ func NewMetadata(issuer uri.URI, endpoints Endpoints, apiScopes []coredata.OAuth
 		IntrospectionEndpoint:       endpoints.Introspection,
 		RevocationEndpoint:          endpoints.Revocation,
 		DeviceAuthorizationEndpoint: endpoints.DeviceAuthorization,
-		ScopesSupported: slices.Concat(
-			[]coredata.OAuth2Scope{
-				ScopeOpenID,
-				ScopeProfile,
-				ScopeEmail,
-				ScopeOfflineAccess,
-			},
-			apiScopes,
-		),
-		ProtectedResources: []uri.URI{issuer},
+		ScopesSupported:             authorizationServerScopes(registeredScopes),
+		ProtectedResources:          []uri.URI{issuer},
 		ResponseTypesSupported: []coredata.OAuth2ResponseType{
 			coredata.OAuth2ResponseTypeCode,
 		},