fix(oauth2): allow users to approve scope changes

[Harsh-128]

This fixes the OAuth2 flow when an existing grant has a different scope from the requested scope.

Previously, users with an existing grant could get an error when an application requested a different scope. Confidential or trusted applications could also reuse the existing grant without showing the consent page.

This change:

• updates the existing grant after the user approves a changed scope
• shows the consent page when a confidential or trusted application requests a different scope
• adds regression tests for both cases

Tests:

• go test ./routers/web/auth ./services/oauth2_provider ./models/auth

Fixes #38940.

[lunny]

It's better to have a hint about the scopes changed in the confirm dialog.

[Harsh-128]

Thanks for the suggestion. I’ll update the confirm dialog to provide a clear hint when the OAuth2 scopes have changed.