Unknown scopes grant nothing, so clients were silently under-privileged. Report every invalid scope at once. Fixes #3406
Add the OAuth client type, its database storage, the scope grant package, policy tag-ownership exposure, and the state operations backing the v2 OAuth client-credentials flow.