auth: request scopes for new server-side OAuth support | DAL-971 DAL-972 DAL-959 DAL-974 DAL-978

[srosenthal-dd]

Motivation

Expand support for OAuth, in particular for the pup CLI and other AI-agent/programmatic clients. OAuth is now a general-purpose auth method, and is preferred over API+App Keys because it's always scoped and credentials automatically expire.

Changes

Add scopes for server-side OAuth support that has now landed, so pup's login tokens carry the required permission:

• metrics_metadata_write
• synthetics_default_settings_write
• ccm_budget_write
• ccm_forecast_write
• security_monitoring_cws_agent_rules_read/write
• telemetry_rules_read/create

Test plan

• CI green
• e2e tested against staging (default scopes, no --extra-scopes needed):
  • metrics metadata update -- no-op update of an existing metric's metadata
  • csm-threats agent-rules create/delete -- created and deleted a throwaway agent rule
  • tag-policies create/delete -- created and deleted a throwaway tag policy
  • costs ccm budgets validate -- reached budget-validation business logic (not an auth error)
  • POST /api/v2/cost/budget/custom-forecast (no dedicated pup command yet) -- reached validation business logic (not an auth error)
  • synthetics default-settings write route has no dedicated pup command either; confirmed the scope clears auth via the raw route (got a business-logic response, not a 401/403)