Add the OAuth2 client credentials management API #3344

The Vuforia Web API Authentication documentation describes a REST API for managing OAuth2 client credentials which the mock does not implement:

• POST /oauth2/clientcredentials with a JSON scopes array, returning 201 and {"clientId": ..., "clientSecret": ...}.
• GET /oauth2/clientcredentials, returning a list of {"clientId": ..., "scopes": [...]}.
• PUT /oauth2/clientcredentials/{clientId}/scopes with a JSON array of scopes.
• DELETE /oauth2/clientcredentials/{clientId}, returning 204.

All of these are authenticated with Authorization: Bearer {JWT}. Errors follow the Microsoft REST API guidelines shape, that is {"error": {"code": ..., "message": ..., "target": ...}}. A maximum of 100 client credentials per account is documented.

This is the API that admin/create_secrets_files.py reaches through vws-web-tools, so a mock would let those admin paths be tested without hitting real Vuforia.

Acceptance criteria

• The mock routes the four client credentials endpoints on both backends.
• Created credentials can be used with POST /oauth2/token to obtain a token whose scopes match the credential.
• Verified fake tests cover create, list, update scopes, delete, and the not-found error shape.
• The 100-credentials-per-account limit is either implemented or documented as out of scope in docs/source/differences-to-vws.rst.

Related to #3192 and #3345.