[WPB-28132] Fix openapi3 docs for oauth scopes.

[fisx]

https://wearezeta.atlassian.net/browse/WPB-28132

This PR fixes two places where the swagger mention of an oauth scope accepted by nginz was forgotten.

It also adds a unit test. In the future, if anybody changes the latest (dev) version in a way that an oauth scope is either:

• documented, but not enforced,
• enforced, but not documented, or
• enforced, but not part of data OAuthScope,

you get a failing test case pointing you to the problem:

    every nginz oauth_scope names a real scope:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             FAIL (0.01s)
      Error message: charts/nginz/values.yaml: 'oauth_scope: thisscopedoesntevenexistwhatsgoingon' matches no scope in Wire.API.OAuth.OAuthScope at any tier, so no OAuth token can ever satisfy it and every endpoint under that location is closed to OAuth.
      Either fix the name, or add the scope.

      CallStack (from HasCallStack):
        assertFailure, called at test/unit/Test/Wire/API/Routes/OAuthScopes.hs:298:7 in wire-api-0.1.0-inplace-wire-api-tests:Test.Wire.API.Routes.OAuthScopes
      Use -p '/every nginz oauth_scope names a real scope/' to rerun this test only.
    enforced scopes and documented scopes agree:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            FAIL (0.20s)
      Error message: OAuth scope declarations are out of sync.

      Columns: version, method, path, accepted by nginz, documented in swagger.
      '-' means no scope. A finding means those last two disagree:

        enforced but not documented  charts/nginz/values.yaml requires a scope the
                                     swagger docs do not mention -- most likely a
                                     missing DescriptionOAuthScope in the routing
                                     table, e.g. on a newly added version of an
                                     endpoint that already had one.
        documented but not enforced  the swagger docs promise a scope nginz does not
                                     require -- a stale annotation, or a missing
                                     oauth_scope: in charts/nginz/values.yaml.

        deviations:
          v17	GET	/self	-	read:self
          v17	GET	/teams/notifications	write:conversations	-
          v17	GET	/teams/{tid}	write:conversations	-
          v17	PUT	/teams/{tid}	write:conversations	-



      CallStack (from HasCallStack):
        assertFailure, called at test/unit/Test/Wire/API/Routes/OAuthScopes.hs:307:30 in wire-api-0.1.0-inplace-wire-api-tests:Test.Wire.API.Routes.OAuthScopes
      Use -p '/enforced scopes and documented scopes agree/' to rerun this test only.

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[fisx]

wire-api> test/unit/Test/Wire/API/Routes/OAuthScopes.hs:98:27: error: [GHC-87897]
wire-api>     • Exception when trying to run compile-time code:
wire-api>         /nix/var/nix/builds/nix-87-2643120627/wire-api/../../charts/nginz/values.yaml: withBinaryFile: does not exist (No such file or directory)
wire-api>       Code: (embedFile
wire-api>                =<< makeRelativeToProject "../../charts/nginz/values.yaml")
wire-api>     • In the untyped splice:
wire-api>         $(embedFile
wire-api>             =<< makeRelativeToProject "../../charts/nginz/values.yaml")
wire-api>    |
wire-api> 98 |   case Yaml.decodeEither' $(embedFile =<< makeRelativeToProject "../../charts/nginz/values.yaml") of
wire-api>    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^