Record access token scope in the grant response

[sberyozkin]

Fixes #48152

The main update is here - if it is authorization code flow token, check the scope from the authorization code flow response as well. This update is really relevant with social providers like GitHub when the token is binary, if it is JWT then JSON with roles/permissions is checked a few lines earlier - which is where I had to fix NPE - until now, we have only enforced @Authenticated at the point of login with social providers.

Updated tests, confirmed I can use for example, @PermissionsAllowed("user:email") with the GitHub login.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit dbcbe87.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.