fix: send scopes on refresh token requests

[danielgtaylor]

This small PR sends the scopes originally requested when fetching an access token to the refresh token endpoint (if one is available). I ran into an issue where Azure Entra refuses the refresh token unless the scopes match the original request. I believe this is safe to do as the spec labels this field as optional and other auth systems should either confirm the scopes are equal or ignore it, but could use some help testing.

BTW, the auth package is missing a lot of tests, so I haven't added one here, but eventually it would be nice to get some tests there.

[Copilot]

Pull Request Overview

This PR ensures that the original scopes are sent along with refresh token requests so that they match what was originally requested, resolving compatibility issues with providers such as Azure Entra.

• The refresh token payload now includes a scope parameter built from a joined string of scopes.
• The authorization code handler now splits the scopes from a comma-separated parameter.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
oauth/refresh.go	Added scope parameter to the refresh token payload.
oauth/authcode.go	Initialized Scopes by splitting the scopes parameter.

[aiven-amartin]

LGTM, but leaving for @cfunkhouser as I don't have time right now to test this out and it should be manually tested against a couple apis before merging given no tests.

[cfunkhouser]

Sorry for the delay here, folks, I was on vacation last week and through the weekend and I'm just getting caught up.

Instead of doing direct string manipulation to create the URL-encoded scopes values, I think it's probably safer to use the net/url.Values type to do it for us. That way, we get the escaping for free, and (I think) it gets us more readable code. I've pushed a commit to this branch to accomplish that.

Regarding sending scopes in the first place, it makes sense to me that it should work fine, especially since @danielgtaylor ran into an implementation specifically requesting it. Testing it, though, is another story! I'm working on test case against Google and Okta, and will report back.