Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/oauth2/metadata_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam/oauth2"
+	"go.probo.inc/probo/pkg/iam/oauth2scope"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/uri"
 )
@@ -29,7 +30,11 @@ import (
 func TestNewMetadata(t *testing.T) {
 	t.Parallel()
 
-	apiScopes := []coredata.OAuth2Scope{probo.ScopeV1DocumentRead}
+	reg := oauth2scope.NewRegistry().Register(
+		map[coredata.OAuth2Scope][]string{
+			probo.ScopeV1DocumentRead: {"core:document:get"},
+		},
+	)
 
 	issuer := uri.URI("https://auth.example.com")
 	endpoints := oauth2.Endpoints{
@@ -43,7 +48,7 @@ func TestNewMetadata(t *testing.T) {
 		DeviceAuthorization: "https://auth.example.com/device",
 	}
 
-	metadata := oauth2.NewMetadata(issuer, endpoints, apiScopes)
+	metadata := oauth2.NewMetadata(issuer, endpoints, reg.RegisteredScopes())
 	require.NotNil(t, metadata)
 
 	t.Run(
@@ -83,7 +88,7 @@ func TestNewMetadata(t *testing.T) {
 					oauth2.ScopeEmail,
 					oauth2.ScopeOfflineAccess,
 				},
-				apiScopes,
+				reg.RegisteredScopes(),
 			)
 
 			assert.Equal(t, expectedScopes, metadata.ScopesSupported)