Extract OidcScopes::SUPPORTED as the shared scope list

The supported-scope list lived on OidcController, so the device authorization
controller (and a test) had to reach across into OidcController::SUPPORTED_SCOPES.
Move it to a shared OidcScopes::SUPPORTED module — one source of truth for the
OIDC controller, the device flow, and consent handling — and update every
reference. No behavior change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie

test/helpers/oidc_helper_test.rb

@@ -12,7 +12,7 @@ class OidcHelperTest < ActionView::TestCase
 
   test "scope_description covers every SUPPORTED_SCOPE (so the consent screens can't silently drop one)" do
     user = User.new(email_address: "person@example.com")
-    OidcController::SUPPORTED_SCOPES.each do |scope|
+    OidcScopes::SUPPORTED.each do |scope|
       assert_not_equal scope, scope_description(scope, user: user),
         "#{scope} has no description and would render as its raw name"
     end