Don't rely on token for scopes collection actions (#210)

Don't rely on token for scopes collection actions

This requires `scope_id` to be passed (via query param) for actions on
the scopes collection; that is, listing or creating. However, it removes
the dependency on using the token for the scope of the command. For
actions on a specific scope, we use the given ID to determine the scope
we should be operating at, doing a lookup if necessary.

Existing tests have been updated. Of particular note, the CORS test was
already operating on the scopes collection so served as a good test to
ensure that from an API level the scope_id parameter was being parsed
and passed through (the tests fail without adding that query parameter
in).

internal/proto/local/controller/api/services/v1/scope_service.proto

@@ -96,7 +96,8 @@ message GetScopeResponse {
 }
 
 message ListScopesRequest {
-  string view = 1;
+  string scope_id = 1;
+  string view = 2;
 }
 
 message ListScopesResponse {
@@ -104,7 +105,8 @@ message ListScopesResponse {
 }
 
 message CreateScopeRequest {
-  resources.scopes.v1.Scope item = 1;
+  string scope_id = 1;
+  resources.scopes.v1.Scope item = 2;
 }
 
 message CreateScopeResponse {