Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/authn/oauth2_access_token_middleware.go

@@ -36,15 +36,19 @@ func NewOAuth2AccessTokenMiddleware(svc *iam.Service) func(next http.Handler) ht
 					return
 				}
 
-				tokenValue, err := bearertoken.Parse(r.Header.Get("Authorization"))
+				authorization := r.Header.Get("Authorization")
+
+				tokenValue, err := bearertoken.Parse(authorization)
 				if err != nil {
 					next.ServeHTTP(w, r)
+
 					return
 				}
 
 				accessToken, err := svc.OAuth2ServerService.LoadAccessToken(ctx, tokenValue)
 				if err != nil {
 					next.ServeHTTP(w, r)
+
 					return
 				}