Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/connect/v1/gqlgen.yaml

@@ -43,4 +43,7 @@ models:
       - "go.probo.inc/probo/pkg/server/gqlutils/types/bigint.BigIntScalar"
   EmailAddr:
     model:
-      - "go.probo.inc/probo/pkg/server/gqlutils/types/mail.AddrScalar"
+      - "go.probo.inc/probo/pkg/server/gqlutils/types/mail.AddrScalar"
+  OAuth2Scope:
+    model:
+      - go.probo.inc/probo/pkg/server/gqlutils/types/oauth2scope.OAuth2ScopeScalar