From all-or-nothing to task-based OAuth consent

Introduced OAuth scope customization, allowing client owners to mark specific scopes as optional when configuring an OAuth client. This enables users to grant a narrower subset of an application's requested access at authorization time, providing more granular control over delegated access. The system evaluates required and optional scopes against the specific authorization request, not the full client configuration. Developers must check the granted scope set after authorization, as access tokens will only contain consented scopes.