Centralize LOLA portability scope enforcement

[aaronjae22]

Part of #279. (PR 1/3)

Something that I found during the first round of testing. This is a small but useful refactor. We had the LOLA portability scope in 7 definitions and 4 manual checks. Now we collapse everything down to one owned module.

activitypub_account_portability was written out in 7 places, and the question "does this scope grant portability?" had 4 independent implementations receiving 3 different input shapes - an oauthlib list at validate_scopes, and space-delimited strings everywhere else.

The neew testbed/core/oauth/scopes.py owns LOLA_PORTABILITY_SCOPE and scope_grants_portability(). The helper splits on a single space per RFC 6749 §3.3 before comparing. This matches what oauthlib and DOT actually emit.

All four decisions now call it: validate_scopes, _save_bearer_token, _has_portability_scope, _prepare_actor_binding.

I added a docstring on validate_scopes that indicates that this server is deliberately stricter than §5 requires for now since it rejects every grant lacking the portability scope, which §5 does not mandate. A comment claiming non-portability federation tokens "keep working unchanged" was removed; they can't be issued here since we don't have any other scope available yet.

OAUTH2_PROVIDER['SCOPES'] still repeats the literal, because settings modules must not import app code.

LOLA spec

§5: "The advertised OAuth endpoint MUST support the activitypub_account_portability scope. That scope MUST be limited to one account." validate_scopes is where the first MUST is enforced, and it's the gate that decides whether a token gets Actor-bound for the second. A false accept there would produce a token that reads as LOLA-scoped everywhere downstream.