Implement OAuth authorization server core functions

[apata]

Changes

Implements core functions of the OAuth authorization server needed for an MCP endpoint. These are not exposed to the internet yet because the SSRF client needs to be validated to work with a large number of external URLs.

Minor tuning:

• Proposes new team_role/1 function @spec team_role(team_id: pos_integer(), user_id: pos_integer()) :: {:ok, Teams.Membership.role()} | {:error, :not_a_member}.

• Makes scopes field required on grant and code, enforces minimum count of 1

• Enforces limits for challenge and verifier. Previously, one could declare an empty verifier, which defeats the purpose.

• Removes optional scopes_supported field from authorization server metadata endpoint: can't declare it here globally because scopes_supported depends on resource.

Tests

• Automated tests have been added

Changelog

• This PR does not make a user-facing change

Documentation

• This change does not need a documentation update

Dark mode

• This PR does not change the UI