Fix: don't drop requested OIDC scopes not listed in scopes_supported

[emmanuelmathot]

What / why

Fixes #930.

OidcProviderInfo.__init__ was intersecting the scopes an openEO backend declares (e.g. api://<client-id>/openeo) against the discovery document's scopes_supported field. Microsoft Entra ID always reports a fixed, tenant-wide scopes_supported (openid, profile, email, offline_access) regardless of the app's actual custom scopes, so the intersection silently dropped the one scope needed to get a usable access token. No openEO backend behind Entra ID could be authenticated against.

Per @soxofaan comment, this implements option 3 from the issue: stop filtering requested scopes against scopes_supported altogether. It's only a RECOMMENDED, descriptive field per RFC 8414 §2

Changes

• openeo/rest/auth/oidc.py: OidcProviderInfo now requests {"openid"} | scopes directly, without intersecting against scopes_supported. The offline_access-if-supported behavior for refresh tokens is unchanged.
• tests/rest/auth/test_oidc.py: added a regression test asserting a requested scope not present in scopes_supported is preserved.
• CHANGELOG.md: entry under Unreleased / Fixed.

Disclosure

This PR was drafted with the help of Claude Code, per AGENTS.md.