fix(oauth): derive default scopes per request #190

Description

OAuthAccessTokenProvider#get_authorization_token derives a default scope when no scopes were configured, but appends it to the provider's persistent @scopes array. Subsequent requests reuse the first request's scope, even when targeting another allowed host.

Relevant implementation: default-scope derivation and token acquisition.

Reproduction

Use one provider with no explicit scopes and allowed_hosts containing one.example.com and two.example.com. A stub token context is sufficient; no credentials or network requests are needed.

1. Resume token acquisition for https://one.example.com.
2. Resume token acquisition for https://two.example.com.
3. Inspect the scopes supplied to the token context on each request.

Observed: both requests initialize the context with https://one.example.com/.default. This was reproduced using Ruby 3.3 in Docker.

Expected: the first request uses https://one.example.com/.default; the second uses https://two.example.com/.default. Explicitly configured scopes should continue to be used unchanged.

Suggested scope and regression coverage

• Derive a request-local default scope without turning it into persistent configured scopes or mutating the caller's scopes array.
• Cover consecutive requests to two allowed HTTPS hosts using the same provider and no explicit scopes.
• Cover explicit scopes remaining unchanged across requests.
• Coordinate token-cache behavior with the effective scopes so that fixing cache reuse does not retain a token for a previous request's scope.

Cross-runtime context

The .NET Azure provider, Java Azure provider, and Dart Azure provider derive fallback scopes per request without persisting the derived value as configured scopes. The TypeScript Azure provider currently persists its first derived scope, so this behavior is not consistent across every runtime.

Related work

• Missing refresh token when using client credentials #116: token caching/refresh handling in the same method; relevant to the effective-scope/cache interaction above.
• fix(oauth): allow http scheme for localhost and return nil on invalid host #187 (for do not require https for local host in azure identity provider #117): localhost/protocol and request-target handling. Its current diff leaves default-scope derivation unchanged.
• fix(oauth): honor allowed hosts when requesting tokens #189: allowed-host early-return handling. Its current diff also leaves default-scope derivation unchanged.

This issue tracks default-scope selection separately from those changes.