feat: let an OAuth2 refresh narrow the granted scope - #28751

TL;DR

First of three in PLAT-481, the last phase of PLAT-470. POST /oauth2/tokens parsed the refresh request's scope and discarded it, so a client asking for less was silently handed the broader token it tried to give up. A refresh may now narrow, and may still not widen.

• Diff is against fix: make OAuth2 code redemption single-use under concurrency #28744, not main.
• Resolves Open Question 7 as coverage, not membership. Membership would leave the narrowing unreachable for most apps: coder:all covers every scope by wildcard but is a member of no set but its own, and every app without a configured allowlist holds exactly that grant, so those clients could never ask for less. Coverage also reuses the authorize-side comparison rather than introducing a third.
• Nothing widens. RFC 6749 §6 bounds the request by the scope originally granted, and an omitted scope still keeps the grant as it stands.

The narrowing (narrowGrantedScope, tokens.go)

• Catalog-checks each requested name before the coverage comparison. Coverage does not reject an unknown name for free the way membership did: it would reach rbac.ExpandScope, fail there, and tell a client that typo'd a scope that the server could not decide, rather than that the name is unknown.
• Returns the string to persist rather than an APIKeyScopes, so scopeStringToAPIKeyScopes converts forward for apikey.Generate and nothing converts backward. The rbacScopesToStrings helper the plan called for is not needed.
• Runs before GetAPIKeyByID, so a rejection costs no further reads and issues nothing. The refresh token stays redeemable.
• firstScopeOutsideAllowlist becomes firstScopeNotCovered and takes its ceiling explicitly. On refresh the ceiling is the token's own grant, so an app_scope log field would have named something the comparison never read.

Tests

• TestNarrowGrantedScope: a genuine subset, a composite narrowed to a constituent it covers, coder:all narrowed to a real scope (the case coverage exists for), an expansion rejected, an unknown name rejected as unknown rather than undecidable, an omitted request left untouched.
• RefreshNarrowsTheScope asserts all three of the minted key, the persisted oauth2_provider_app_tokens.scope column and the response scope. The next refresh inherits that column, so a widened one would undo the narrowing.
• RefreshCannotWidenTheScope asserts the 400 and that the original token is still redeemable.
• ResponseStatesTheScopeGranted pins RFC 6749 §5.1 for both an omitted-scope exchange and a narrowed refresh, which no test asserted on purpose before.

Docs: the Limitations bullet saying a client cannot narrow on refresh is now false and is deleted; the token-endpoint invalid_scope section documents the narrowing and both rejection wordings.

Stack: #28237, #28740, #28744, this PR.