Unhide mcp and mcp_orbit scopes on admin OAuth applications form

Summary

Previously, mcp and mcp_orbit scopes were hidden from all OAuth app forms because MCP clients were only supported via Dynamic Client Registration (DCR), which auto-assigns the correct scope based on the resource URL — manual scope selection was unnecessary and potentially confusing.

We now also support pre-registered OAuth apps as an alternative to DCR, and will soon add an instance-level setting to disable DCR entirely. Admins need to be able to pre-register apps with mcp and mcp_orbit scopes via /admin/applications to support this workflow.

This overrides load_scopes in Admin::ApplicationsController to include mcp and mcp_orbit. These scopes remain hidden from:

• User-level OAuth apps (/oauth/applications)
• Group-level OAuth apps
• Personal access tokens
• Project access tokens

References

• MCP: unhide `mcp` scope on admin OAuth applicat... (#601437 - closed)
• Document reuse of OAuth apps instead of always ... (#595569 - closed)
• MCP: support pre-registered clients alongside D... (#599020)

Screenshots