Add opt-in OAuth endpoint scopes and bump to 2.15.0

[jakeichikawasalesforce]

Summary

Adds opt-in per-endpoint JWT scopes on TabPy's HTTP path and ships the OAuth work (HTTP #664, Flight #665, and this change) as 2.15.0. This is the last TabPy OSS story in the OAuth epic.

• New config TABPY_OAUTH_ENFORCE_ENDPOINT_SCOPES (default false).
  When false, existing OAuth installations keep working and tokens without a
  scope claim are unchanged.
• When true, after a valid JWT:
  • /query requires the configured query scope
  • /evaluate requires the configured evaluate scope
  • mutating management operations (POST /endpoints,
    PUT/DELETE /endpoints/{name}, and
    GET /configurations/endpoint_upload_destination) require the configured
    deploy scope
• Endpoint scope names are configurable:
  • TABPY_OAUTH_QUERY_SCOPE defaults to tabpy:query
  • TABPY_OAUTH_EVALUATE_SCOPE defaults to tabpy:evaluate
  • TABPY_OAUTH_DEPLOY_SCOPE defaults to tabpy:deploy
• Configurable names support IdP-specific conventions such as Amazon Cognito's
  slash-form scopes (tabpy/query, tabpy/evaluate, and tabpy/deploy).
  Invalid scope tokens fail startup validation. Reusing one scope for multiple
  endpoint groups is allowed but logs a warning.
• Insufficient endpoint scope returns 403 with
  WWW-Authenticate: Bearer error="insufficient_scope". Global
  TABPY_OAUTH_REQUIRED_SCOPES misses remain 401.
• /info, /status, and GET /endpoints are not gated by endpoint scopes.
  /info advertises the configured query, evaluate, and deploy scope names
  under oauth-jwt, even when enforcement is off.
• Nested tabpy.query() from /evaluate forwards the original token, so it
  requires both the configured evaluate and query scopes.
• Arrow Flight is not per-endpoint scoped and continues to use only
  TABPY_OAUTH_REQUIRED_SCOPES. Basic Auth is unaffected.
• Bumps tabpy/VERSION to 2.15.0 and documents the OAuth feature in
  CHANGELOG and docs/server-config.md.

Testing

• Unit coverage for:
  • path and method scope mapping
  • default and configured scope names
  • configuration validation and /info advertisement
  • query, evaluate, and deploy enforcement
  • negative management cases
  • duplicate-scope warnings
  • Basic Auth and global-scope compatibility
• Focused OAuth/JWT/config suites pass on Python 3.13.