Add opt-in OAuth endpoint scopes and bump to 2.15.0

[jakeichikawasalesforce]

Summary

Adds opt-in per-endpoint JWT scopes on TabPy's HTTP path and ships the
OAuth work (HTTP #664, Flight #665, and this change) as 2.15.0. Companion
to those PRs; this one is the last TabPy OSS story in the OAuth epic.

• New config TABPY_OAUTH_ENFORCE_ENDPOINT_SCOPES (default false).
  When false, existing OAuth installs keep working; tokens with no
  scope claim are unchanged.
• When true, after a valid JWT:
  • /query requires tabpy:query
  • /evaluate requires tabpy:evaluate
  • mutating management (POST /endpoints, PUT/DELETE /endpoints/{name}, GET /configurations/endpoint_upload_destination)
    requires tabpy:deploy
• Insufficient endpoint scope returns 403 with
  WWW-Authenticate: Bearer error="insufficient_scope". Global
  TABPY_OAUTH_REQUIRED_SCOPES misses stay 401.
• /info, /status, and GET /endpoints are not gated by those
  scopes. /info advertises the three well-known names under
  oauth-jwt even when enforcement is off.
• Nested tabpy.query() from /evaluate still forwards the original
  token, so that path needs both tabpy:evaluate and tabpy:query.
• Arrow Flight is not per-endpoint scoped; it still uses only
  TABPY_OAUTH_REQUIRED_SCOPES. Basic Auth is unaffected.
• Bumps tabpy/VERSION to 2.15.0 and documents the OAuth feature in
  CHANGELOG and docs/server-config.md.

Testing

• Unit tests covering path/method scope mapping (test_jwt_auth.py),
  HTTP enforcement including query/evaluate/deploy and negative
  management cases (test_oauth_handler.py), and config//info
  advertisement (test_config.py).
• Focused suites: 102 passed.