CGDMF-48: Validate API scopes

[wouterpot]

The different commits show a few different approaches to setting scopes for endpoints. If you're interested to see the other approaches, review by commit otherwise go straight to the aggregate view.

[Copilot]

Pull request overview

This pull request implements API scope validation for the Documenten API by adding JWT scope checking to all protected endpoints. The implementation follows OAuth2 standards for scope claims and includes wildcard scope matching for administrative convenience.

Changes:

• Introduces a new checkScope function that validates JWT scopes against required permissions for each endpoint
• Adds scope checks to all CRUD operations across EnkelvoudigInformatieObjecten, ObjectInformatieObjecten, and AuditTrail routes using Dutch scope names (e.g., "documenten.lezen", "documenten.aanmaken")
• Implements comprehensive test coverage for the scope checking mechanism, including wildcard matching and multiple scope validation

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/main/kotlin/api/routes/CheckScope.kt	New scope authorization implementation with JWT claim extraction, wildcard matching, and custom exception handling
src/test/kotlin/api/middleware/CheckScopeTest.kt	Comprehensive test suite covering various scope validation scenarios including multiple scopes, wildcards, and array-style scopes
src/main/kotlin/api/routes/EnkelvoudigInformatieObjectenRoutes.kt	Adds scope checks to all document CRUD operations (list, create, get, put, patch, delete, download, lock, unlock) and cleans up import ordering
src/main/kotlin/api/routes/ObjectInformatieObjectenRoutes.kt	Adds scope checks to object relation operations (list, create, get, delete)
src/main/kotlin/api/routes/AuditTrailRoutes.kt	Adds scope checks to audit trail endpoints and refactors to use RequestScopeKey pattern for service retrieval
src/main/kotlin/api/middleware/GlobalExceptionHandler.kt	Adds ScopeAuthorizationException handler that returns proper 403 Forbidden responses with detailed error messages
src/main/kotlin/api/DocumentenApiRoutes.kt	Minor import consolidation cleanup