Unhide mcp scopes on group and user OAuth application forms

What does this MR do and why?

Expose the mcp and mcp_orbit scopes on group-level and user-level OAuth application forms (Groups::Settings::ApplicationsController and Oauth::ApplicationsController), mirroring the admin form change in !245979 (merged).

Why

MCP clients that use a pre-registered OAuth application (a fixed client_id, rather than Dynamic Client Registration) need that application to hold the mcp scope — the MCP endpoint (lib/api/mcp/base.rb, allow_access_with_scope :mcp) requires it.

Before this merge request, mcp/mcp_orbit are filtered out of the group and user OAuth app forms by OauthApplications#excluded_scopes, so those apps cannot be granted mcp through the UI. The resulting apps fail authorization with "The requested scope is invalid, unknown, or malformed" — the regression tracked in #603748 (closed).

!245979 (merged) unhid these scopes for admin (/admin/applications) only. This extends the same override to group- and user-owned apps. Personal/project access tokens are unchanged (still exclude mcp).

Group vs user — different motivations:

• Group-level there is no REST API for group OAuth apps (only instance POST /api/v4/applications and user POST /api/v4/user/applications exist), so the form is the only way to pre-register a group-owned MCP app. This is the fix for #603748 (closed).
• User-level is convenience/discoverability: the User Applications API (POST /api/v4/user/applications) already accepts mcp (verified — a non-admin request returns 201 with "scopes":["mcp"]), so this just brings the UI in line with the API and with the admin form.

Implementation

• Override excluded_scopes in Groups::Settings::ApplicationsController and Oauth::ApplicationsController to re-include mcp/mcp_orbit (same one-line pattern as the admin controller).
• Generalize the scopes include mcp shared example so the admin, group, and user request specs share it without duplicating the scope list; drop the now-unused scopes exclude mcp / GET #new examples.

Tl;DR on the impact of this MR

For group apps this is a real new capability (no API path exists today). For user apps it only mirrors what the User Applications API already allows, so the security delta there is nil.

How to verify locally

1. As a group owner (Group → Settings → Applications) and as a user (User Settings → Applications), confirm mcp/mcp_orbit now appear as scope checkboxes.
2. Create an app with the mcp scope; confirm it saves.
3. Point a pre-registered MCP client (e.g. Cursor static OAuth with that client_id and "scopes": ["mcp"]) at …/api/v4/mcp; the OAuth flow now succeeds instead of failing with invalid_scope.

References

• Related to #603748 (closed) — MCP Server OAuth flow scope error has regressed on GitLab.com
• Follows !245979 (merged) — Unhide mcp and mcp_orbit scopes on admin OAuth applications form