Gate granular OAuth tokens on their own flag

What does this MR do and why?

Part of #608636. Stacked on !257023 (merged) and targeting its branch until that merges. This MR is one of several split out of !257024 (closed). The Oauth::AuthorizationsController change is in !260062.

It adds the default-off feature flag granular_oauth_tokens (type wip). Authz::Tokens::AuthorizeGranularScopesService now checks it for OAuth access tokens instead of granular_personal_access_tokens. Personal access tokens keep their own flag. Nothing mints granular OAuth tokens yet, so there is no effect today. Later, one flag controls both minting and using them.

There are no migrations and no new queries.

References

• Work item: #608636
• Technical design: https://gitlab.com/gitlab-org/gitlab/-/work_items/605869
• Stack base: !257023 (merged)
• Original MR: !257024 (closed)
• Controller change: !260062
• Consent grant services: !260051

Screenshots or screen recordings

Not applicable. There is no UI change.

How to set up and validate locally

1. Make a request with a granular OAuth token while granular_oauth_tokens is disabled and confirm it is denied.
2. Run Feature.enable(:granular_oauth_tokens) in a Rails console and repeat the request. It is now allowed.

There is no UI to check. The rest is covered by specs.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code