feat(oidc): organization roles scope (#8120)

# Which Problems Are Solved

An admin / application might want to be able to reduce the amount of
roles returned in the token, for example if a user is granted to many
organizations or for specific cases where the application want to narrow
down the access for that token to a specific organization or multiple.
This can now be achieved by providing a scope with the id of the
organization, resp. multiple scopes for every organization, which should
be included.

```
urn:zitadel:iam:org:roles🆔{orgID}
```

**Note:** the new scope does not work when Introspection / Userinfo are
set to legacy mode.

# How the Problems Are Solved

The user info query now has two variants:

1. Variant that returns all organization authorization grants if the new
scope wasn't provided for backward compatibility.
2. Variant that filters the organizations based on the IDs passed in one
or more of the above scopes and returns only those authorization grants.

The query is defined as a `text/template` and both variants are rendered
once in package `init()`.

# Additional Changes

- In the integration tests `assertProjectRoleClaims` now also checks the
org IDs in the roles.

# Additional Context

- Closes #7996

internal/domain/token_test.go

@@ -0,0 +1,45 @@
+package domain
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRoleOrgIDsFromScope(t *testing.T) {
+	type args struct {
+		scopes []string
+	}
+	tests := []struct {
+		name string
+		args args
+		want []string
+	}{
+		{
+			name: "nil",
+			args: args{nil},
+			want: nil,
+		},
+		{
+			name: "unrelated scope",
+			args: args{[]string{"foo", "bar"}},
+			want: nil,
+		},
+		{
+			name: "orgID role scope",
+			args: args{[]string{OrgRoleIDScope + "123"}},
+			want: []string{"123"},
+		},
+		{
+			name: "mixed scope",
+			args: args{[]string{"foo", OrgRoleIDScope + "123"}},
+			want: []string{"123"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := RoleOrgIDsFromScope(tt.args.scopes)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}