fix: treat None client scope as no restrictions in validate_scope()

[MaxwellCalkin]

Note: This PR was authored by Claude (AI), operated by @MaxwellCalkin.

Summary

Fixes #2216

OAuthClientMetadata.validate_scope() incorrectly handles the case where a client is registered without scope restrictions (self.scope is None). The existing code converts None to an empty list of allowed scopes:

allowed_scopes = [] if self.scope is None else self.scope.split(" ")

This means every requested scope fails the if scope not in allowed_scopes check, raising InvalidScopeError even though the client should have no restrictions.

Fix

When self.scope is None, return the requested scopes immediately — None means "no restrictions", not "no scopes allowed":

requested_scopes = requested_scope.split(" ")
if self.scope is None:
    # No scope restrictions registered for this client; allow any scopes
    return requested_scopes
allowed_scopes = self.scope.split(" ")

Tests

Added TestValidateScope class to tests/shared/test_auth.py with regression tests covering:

• None client scope allows any requested scopes (the bug from Bug: validate_scope rejects client scopes when required scopes in None #2216)
• None requested scope returns None
• Valid subset of registered scopes is accepted
• Unregistered scope raises InvalidScopeError