refactor scopes for user services

[aditya-mitra]

Summary

🤖 Generated by Copilot at 6136ff2

The pull request updates the scope verification logic for various user-related services to improve security and consistency. It also adds some comments to flag potential issues with the 'admin:admin' scope. The affected files are avatar.hooks.ts, github-repo-access.hooks.ts, user.hooks.ts, accept-invite.class.ts, and identity-provider.hooks.ts.

References

refs #9161

Explanation

🤖 Generated by Copilot at 6136ff2

• Simplified scope verification logic for user service hooks using checkScope function (link, link)
• Relaxed scope requirements for user service hooks to allow either admin or user permissions (link, link)
• Changed scope requirements for avatar service hooks to use global avatar permissions instead of admin permissions (link, link)
• Changed scope requirements for github-repo-access service hooks to use project permissions instead of admin permissions (link, link)
• Added comments to accept-invite.class.ts and identity-provider.hooks.ts expressing doubts about scope logic for invitee users and users with admin scopes (link, link)

🤖 Generated by Copilot at 6136ff2

We're checking scopes for every hook
We're making sure they're by the book
We're fixing bugs and cleaning code
We're heaving on the count of three

QA Steps

List any additional steps required to QA the changes of this PR, as well as any supplemental images or videos.

Checklist

• If this PR is still a WIP, convert to a draft
• When this PR is ready, mark it as "Ready for review"
• ensure all checks pass
• Changes have been manually QA'd
• Changes reviewed by at least 2 approved reviewers