feat: improve OAuth client secret support with --advertise-tags flag

[DAcodedBEAT]

• Add --advertise-tags CLI flag (also reads TS_ADVERTISE_TAGS env var)
• Update README with required OAuth scope: Auth Keys → Write

Usage examples

% TS_AUTHKEY=tskey-client-<...> TS_ADVERTISE_TAGS=tag:tsidp ./tsidp-server
2026/04/08 22:40:17 INFO Using advertise tags tags=tag:tsidp
2026/04/08 22:40:17 tsnet running state path /Users/<user>/Library/Application Support/tsnet-tsidp-server/tailscaled.state
2026/04/08 22:40:17 tsnet starting with hostname "idp", varRoot "/Users/<user>/Library/Application Support/tsnet-tsidp-server"
2026/04/08 22:40:17 Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.
2026/04/08 22:40:19 INFO tsidp server started server_url=https://idp.<tailnet>.ts.net
2026/04/08 22:40:22 AuthLoop: state is Running; done
^C2026/04/08 22:40:28 INFO interrupt, exiting

% TS_AUTHKEY=tskey-client-<...> ./tsidp-server --advertise-tags tag:tsidp
2026/04/08 22:42:17 INFO Using advertise tags tags=tag:tsidp
2026/04/08 22:42:17 tsnet running state path /Users/<user>/Library/Application Support/tsnet-tsidp-server/tailscaled.state
2026/04/08 22:42:17 tsnet starting with hostname "idp", varRoot "/Users/<user>/Library/Application Support/tsnet-tsidp-server"
2026/04/08 22:42:17 Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.
2026/04/08 22:42:19 INFO tsidp server started server_url=https://idp.<tailnet>.ts.net
2026/04/08 22:42:22 AuthLoop: state is Running; done
^C2026/04/08 22:42:24 INFO interrupt, exiting

[mikeodr]

Thank you for the PR and documentation updates.