Align authserver DCR client scopes with discovery scopes_supported

[jhrozek]

DCR was assigning hardcoded DefaultScopes ["openid", "profile", "email"] to registered clients, while the discovery document advertised whatever was configured in oidcConfig.inline.scopes. When those differed, clients would read scopes_supported from discovery, request those scopes, and get rejected by fosite because the client wasn't allowed them.

For example, with this MCPServer config:

    oidcConfig:
      inline:
        scopes: [user:email, read:user, repo]

the discovery document would advertise scopes_supported: ["user:email", "read:user", "repo"], but a DCR client would only be allowed ["openid", "profile", "email"]. Requesting "user:email" would fail with invalid_scope.

The fix: DCR now reads h.config.ScopesSupported so clients are allowed to request exactly the scopes the server advertises. The config default for ScopesSupported references registration.DefaultScopes directly, giving a single source of truth instead of two arrays to keep in sync.

[jhrozek]

@tgrunnagle I saw one of your manifests using explicit scopes in the oidcConfig.inline.scopes attribute and realized (by testing and running into a bug) that we don't handle the situation well, all my testing was using implicit scopes for the auth server. This fixes the bug. Although in most cases explicit scopes should not be needed, the upstream scopes are configured separately using MCPExternalAuthConfig.upstreamProviders[].scopes

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.54%. Comparing base (f16d0cc) to head (89ad09c).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3610      +/-   ##
==========================================
- Coverage   65.61%   65.54%   -0.07%     
==========================================
  Files         407      407              
  Lines       40246    40247       +1     
==========================================
- Hits        26407    26381      -26     
- Misses      11779    11806      +27     
  Partials     2060     2060              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.