Request advanced Model Target scope and convert advanced mock-only test

[adamtheturtle]

Follow-up to #3196 and #3197.

tests/mock_vws/test_model_target_web_api.py::TestMockOnlyErrors::test_advanced_model_count_exceeds_limit is currently mock-only because the OAuth2 client created by admin/create_secrets_files.py (via vws-web-tools) is not entitled to the advanced Model Target scope, so calls to /modeltargets/advancedDatasets get a 403 invalid_scope from real Vuforia before any validation runs.

Acceptance criteria

• admin/create_secrets_files.py requests the advanced Model Target scope when creating Model Target Web API credentials (via the vws-web-tools API added in Support requesting the advanced Model Target Web API scope vws-web-tools#1393).
• Existing CI secrets are regenerated against an Enterprise-tier developer account so the credentials carry both modeltargets.standardmodeltarget.all and modeltargets.advancedmodeltarget.all.
• The advanced-dataset model-count validation test is moved out of TestMockOnlyErrors and into TestErrorResponses so it runs against real Vuforia + both mock backends, with the mock updated if the observed response shape differs from the current implementation.
• docs/source/differences-to-vws.rst is updated to remove the documented mock-only rationale for the advanced-dataset model-count case.

Ordering / dependencies

This issue is blocked by, in order:

1. A Vuforia Enterprise developer account entitled to modeltargets.advancedmodeltarget.all.
2. Support requesting the advanced Model Target Web API scope vws-web-tools#1393 — vws-web-tools supports requesting the advanced scope.
3. This issue — switch credential creation here to request the advanced scope and convert the remaining mock-only test.

Until steps 1 and 2 are done, the existing mock-only test with its documented rationale stays as the closest available coverage.