feat(auth): add scopes and org selection to ApiApplication

[sentaur-athena]

We want to be able to provides scopes for each application and store it in the model. Today the application requests the scope which is too loose.

The second change is to be able to limit the application scope to one org at a time. Basically if requires_org_level_access is true the user has to give the app permission twice to give the app access to 2 orgs.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #76974       +/-   ##
===========================================
+ Coverage   57.14%   78.18%   +21.03%     
===========================================
  Files        6902     6912       +10     
  Lines      306931   307293      +362     
  Branches    50305    50350       +45     
===========================================
+ Hits       175408   240242    +64834     
+ Misses     126725    60605    -66120     
- Partials     4798     6446     +1648     

[github-actions]

This PR has a migration; here is the generated SQL for src/sentry/migrations/0754_add_scopes_to_apiapplication.py ()

--
-- Custom state/database change combination
--

                    ALTER TABLE "sentry_apiapplication"
                    ADD COLUMN "scopes" TEXT[] NULL,
                    ADD COLUMN "requires_org_level_access" BOOLEAN DEFAULT FALSE;

[wedamija]

Jfyi, you can just include this as a separate operation outside of the SeparateDatabaseAndState. It's safe to create a nullable column

[github-actions]

This PR has a migration; here is the generated SQL for src/sentry/migrations/0755_add_scopes_to_apiapplication.py ()

--
-- Custom state/database change combination
--

                    ALTER TABLE "sentry_apiapplication"
                    ADD COLUMN "scopes" TEXT[] NULL,
                    ADD COLUMN "requires_org_level_access" BOOLEAN DEFAULT FALSE;

[markstory]

We want to be able to provides scopes for each application and store it in the model. Today the application requests the scope which is too loose.

What will happen if an apiapplication has scopes stored in the database and a different set of scopes is provided during the authorization flow?

[sentaur-athena]

@markstory we respect data base if it's tighter than what the app is asking for. For now though it's nullable and if it's null we don't change behavior at all.

[github-actions]

This PR has a migration; here is the generated SQL for src/sentry/migrations/0757_add_scopes_to_apiapplication.py ()

--
-- Custom state/database change combination
--

                    ALTER TABLE "sentry_apiapplication"
                    ADD COLUMN "scopes" TEXT[] NULL,
                    ADD COLUMN "requires_org_level_access" BOOLEAN DEFAULT FALSE;