feat(api): Audit undeclared runtime permission scopes (#122046)

API endpoints can now report when their implementation checks a
permission
scope that is absent from the current method's permission-class
declarations.
When the default-off `api.permission-scope-audit.enabled` option is
enabled,
dispatch binds the endpoint declaration for the request and centralized
access
checks emit one structured warning and warning-level Sentry event per
scope,
with stable endpoint, method, and scope grouping.

Permission `scope_map` entries remain any-of token admission lists, so
findings
are diagnostic and should receive an authorization review rather than
being
resolved by automatically adding scopes. A pytest plugin enables the
audit for
existing endpoint suites, aggregates findings, and suppresses only the
detector's event capture during audit runs.

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>