Support the OAuth2 password grant and scopes on /oauth2/token #3345

The Vuforia Web API Authentication documentation describes two grant types for POST /oauth2/token, and a scope field on both. The mock supports neither fully:

• src/mock_vws/_model_target_web_api.py rejects any grant_type other than client_credentials with unsupported_grant_type. The documented password grant, which takes username and password form fields and is the flow used to bootstrap client credentials, is not supported.
• The optional scope form field is ignored, and the returned token carries no scopes. As a result, a token minted by the mock is accepted by /modeltargets/advancedDatasets, whereas real Vuforia rejects an unscoped client with 403 invalid_scope before any validation runs. See Request advanced Model Target scope and convert advanced mock-only test #3202.

The documented scopes are oauth2.clientcredentials.all, modeltargets.all, modeltargets.standardmodeltarget.all, modeltargets.advancedmodeltarget.all, modeltargets.statebasedmodeltarget.all, modeltargets.advancedstatebasedmodeltarget.all, the areatargets.* family, and datasetsignature.create.

Acceptance criteria

• POST /oauth2/token supports grant_type=password with username and password, and validates the required fields.
• The scope field is honoured for both grant types and the resulting token carries those scopes.
• Model Target routes reject tokens which lack the scope documented for that route in the Model Target OpenAPI spec, with a Vuforia-like status code and body.
• Verified fake tests cover a password grant, a scoped client credentials grant, and a request made with an insufficiently scoped token.
• Any remaining differences are documented in docs/source/differences-to-vws.rst.

Related to #3192, #3202 and #3344.