Return the correct scopes when bypassing auth

What does this merge request do and why?

Return the correct scopes when bypassing auth.

Developers can opt in to disable authentication for testing by setting AUTH_BYPASS_EXTERNAL=true. Since permission scope is introduced (MR), the authentication credentials for this use case no longer works since the permission scopes are not set correctly. This results in Forbidden error and prohibits us from using this particular flag.

How to set up and validate locally

1. Check out to this merge request's branch.
2. Ensure a local Docker image built successfully.

   docker buildx build --platform linux/amd64 -t ai-gateway:test .

3. Run a local service on Docker.

   docker run --platform linux/amd64 --rm \
     -p 5052:5052 \
     -e AUTH_BYPASS_EXTERNAL=true \
     -v $PWD:/app -it ai-gateway:test

4. Send a cURL request to the /v2/completions endpoint

   $ curl --request POST \
     --url http://codesuggestions.gdk.test:5052/v2/completions \
     --header 'Content-Type: application/json' \
     --header 'X-Gitlab-Authentication-Type: oidc' \
     --header 'authorization: Bearer jwt \
     --data '{
     "prompt_version": 1,
     "project_path": "gitlab-org/gitlab",
     "project_id": 278964,
     "current_file": {
       "file_name": "main.py",
       "content_above_cursor": "# complete this world\n",
       "content_below_cursor": ""
     }
   }'

5. We should not see 403 Forbidden error.

Merge request checklist

• Tests added for new functionality. If not, please raise an issue to follow up.
• Documentation added/updated, if needed.