Document app password scopes for app developers #15970

Part of nextcloud/server#65523

Once the scopes stack is merged, app developers need a page in the developer manual on how to make their app work with limited app passwords.

What it should cover:

• Limited app passwords reach nothing by default: no routes without a scope, no pages, no admin-only routes
• #[TokenScope] on controllers and methods (unstable until 37), and that a method's attribute replaces the class one
• Scope naming (<appid>:<resource>:<action>), and that non-shipped apps can only use their own app id
• DAV collections registered in info.xml: <appid>:dav:read / :write, and the whole-app grant
• The built-in scopes (Files, Calendar, Contacts, search, people, notifications)
• Which apps can be granted as a whole and which can't