Add migration to update ApiClients with centralized authorization scopes

This migration updates the ScopesJson for the ApiClient with Id 91000000-0000-0000-0000-000000000001 to include additional authorization scopes for improved API access control. The Down method reverts the changes if necessary.

.tests/OnPremClientCredentials.Api.Tests.ps1

@@ -66,25 +66,69 @@ function Invoke-TestApi {
     }
 }
 
+function Invoke-TestApiExpectFailure {
+    param(
+        [ValidateSet('GET', 'POST', 'DELETE')]
+        [string]$Method,
+
+        [string]$Path,
+
+        [object]$Body,
+
+        [string]$BearerToken
+    )
+
+    $uri = ('{0}/{1}' -f $ApiBaseUrl.TrimEnd('/'), $Path.TrimStart('/'))
+    $parameters = @{
+        Method = $Method
+        Uri = $uri
+        TimeoutSec = $ApiTimeoutSec
+        ErrorAction = 'Stop'
+    }
+
+    if ($Body) {
+        $parameters.Body = ($Body | ConvertTo-Json -Depth 10)
+        $parameters.ContentType = 'application/json'
+    }
+
+    if ($BearerToken) {
+        $parameters.Headers = @{
+            Authorization = "Bearer $BearerToken"
+        }
+    }
+
+    try {
+        Invoke-RestMethod @parameters | Out-Null
+        throw "API request was expected to fail but succeeded. Method=[$Method], Uri=[$uri]."
+    }
+    catch {
+        if ($_.Exception.Response -and $_.Exception.Response.StatusCode) {
+            return [int]$_.Exception.Response.StatusCode
+        }
+
+        throw
+    }
+}
+
 Describe 'On-prem client credentials API authentication' {
     It 'issues a bearer token for the seeded demo worker client' {
         $token = Invoke-TestApi -Method POST -Path 'auth/token' -Body @{
             clientId = $ClientId
             clientSecret = $ClientSecret
-            scope = 'deployment.read template.read'
+            scope = 'configuration.read'
         }
 
         $token.accessToken | Should Not BeNullOrEmpty
         $token.tokenType | Should Be 'Bearer'
         $token.expiresIn | Should BeGreaterThan 0
-        $token.scope | Should Be 'deployment.read template.read'
+        $token.scope | Should Be 'configuration.read'
     }
 
     It 'allows bearer-token API calls without Windows authentication' {
         $token = Invoke-TestApi -Method POST -Path 'auth/token' -Body @{
             clientId = $ClientId
             clientSecret = $ClientSecret
-            scope = 'deployment.read template.read'
+            scope = 'configuration.read'
         }
 
         $definitions = @(Invoke-TestApi -Method GET -Path 'configuration-definitions?kind=Parameter' -BearerToken $token.accessToken)
@@ -93,6 +137,18 @@ Describe 'On-prem client credentials API authentication' {
         @($definitions | Where-Object { $_.kind -ne 'Parameter' }).Count | Should Be 0
     }
 
+    It 'rejects bearer-token API calls without the required scope' {
+        $token = Invoke-TestApi -Method POST -Path 'auth/token' -Body @{
+            clientId = $ClientId
+            clientSecret = $ClientSecret
+            scope = 'deployment.read'
+        }
+
+        $statusCode = Invoke-TestApiExpectFailure -Method GET -Path 'configuration-definitions?kind=Parameter' -BearerToken $token.accessToken
+
+        @(401, 403) -contains $statusCode | Should Be $true
+    }
+
     It 'creates, lists and revokes managed tokens through the token API' {
         $adminToken = Invoke-TestApi -Method POST -Path 'auth/token' -Body @{
             clientId = $ClientId