Register API scopes on prb CLI OAuth client

Device logins only requested OIDC scopes while the authorizer now
gates API calls on v1:* scopes. Register the full scope set on the
well-known prb client, request it at login via CLIClientScopes, and
cover the device flow in e2e.

Collapse API scopes under an accordion on the consent screen and
document scope sync for future namespace additions.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/cmd/auth/login/login.go

@@ -312,7 +312,7 @@ func requestDeviceCode(
 ) (*deviceAuthResponse, error) {
 	values := url.Values{
 		"client_id": {clientID},
-		"scope":     {"openid profile email offline_access"},
+		"scope":     {config.CLIClientScopes},
 	}
 
 	req, err := http.NewRequest(