Fix OAuth2 authorization loop when grant scope changes

[mango766]

Summary

• Fix infinite redirect loop when an OAuth2 client requests a different scope than a user's existing grant
• Add OAuth2Grant.SetScope() method to update the scope of an existing grant in the database
• Update GrantApplicationOAuth() to update the grant scope instead of returning a server_error when scopes differ
• Update AuthorizeOAuth() to sync grant scope for confidential/trusted clients on auto-redirect

Fixes #36762

Details

When an OAuth2 client changes its requested scope (e.g., from repository to read:repository,write:repository,read:user), and a user has a pre-existing grant with the old scope, the GrantApplicationOAuth handler previously returned a server_error to the redirect_uri. Since the OAuth2 client typically retries the authorization flow upon receiving an error, this created an infinite redirect loop with no way for the user to recover through the UI.

This PR updates the grant's scope in the database when the user re-authorizes with a different scope. Since the user has already explicitly consented to the new permissions by clicking "Authorize" on the authorization page, this is safe and expected behavior.

The fix also addresses the related issue for confidential clients and applications with skip_secondary_authorization enabled, where AuthorizeOAuth() auto-redirects using the old grant's scope without updating it.

Test plan

• Verify that re-authorizing an OAuth2 application with a different scope succeeds without redirect loops
• Verify that the oauth2_grant table is updated with the new scope
• Verify that confidential clients receive tokens with the updated scope when the requested scope changes
• Verify that initial authorization (no existing grant) still works correctly
• Verify that re-authorization with the same scope still works correctly