fix: fetch token scope from discovery endpoint

[mortenpi]

Fetches the scope= value of the device token from the configuration endpoint (device_token_scope property). If that is not set, we assume that scope= should not be passed (it's optional according to RFC 8628). X-ref: #42 (comment)

[nkottary]

@mortenpi Would be good to update device_token_scope in the tests as well:

PkgAuthentication.jl/test/authserver.jl

Line 125 in 3e66ca1

"device_token_endpoint": "http://localhost:$PORT/auth/token"

[mortenpi]

@nkottary I updated the tests. I also added a new set that tests the case where device_token_scope is unset. We could also check that PkgAuthentication also correctly sets (or doesn't set) scope= in the device request body, but I think it's not critical.