Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/connect/v1/oauth2_access_token_resolvers.go

@@ -36,11 +36,10 @@ func (r *mutationResolver) CreateOAuth2AccessToken(ctx context.Context, input ty
 	tokenValue, accessToken, err := r.iam.OAuth2ServerService.CreateManualAccessToken(
 		ctx,
 		&oauth2.CreateManualAccessTokenRequest{
-			IdentityID:       identity.ID,
-			Name:             strings.TrimSpace(input.Name),
-			ExpiresAt:        input.ExpiresAt,
-			Scopes:           scopes,
-			AllowedAPIScopes: r.iam.OAuth2ScopeSet.APIScopes(),
+			IdentityID: identity.ID,
+			Name:       strings.TrimSpace(input.Name),
+			ExpiresAt:  input.ExpiresAt,
+			Scopes:     scopes,
 		},
 	)
 	if err != nil {