Feat: Kong Identity auth server scope support

Parent: #1133

Track kongctl support for scopes scoped to Kong Identity auth servers.

## Dependencies

- #1399 must confirm usable SDK/client support for auth-server scope operations.
- #1400 should establish the auth-server parent resource and reference model.

## Scope

- Define the declarative scope resource shape under an auth server, including matching/update behavior once the API contract is confirmed.
- Add plan, diff, apply, delete, sync, dump, explain, and scaffold support for scopes.
- Add imperative `get`, `list`, and `adopt` support scoped by auth server.
- Confirm how scopes attach to clients or claims, if applicable, and model references instead of requiring raw IDs where possible.
- Add docs and tests for nested and sync-scoped behavior.

## Acceptance criteria

- [ ] Auth-server scopes can be managed declaratively under an auth server.
- [ ] Auth-server scopes can be inspected and adopted imperatively.
- [ ] References between scopes and related auth-server resources are usable without raw Konnect IDs where the API allows it.
- [ ] Tests cover create, update, idempotency, dump, and delete/sync semantics.

Start by reviewing dependencies #1399 and #1400 to confirm SDK/client operations and the auth-server parent and reference model. Then trace the existing resource patterns for plan, diff, apply, sync, dump, explain, scaffold, get, list, and adopt. Done means declarative and imperative scope management works under an auth server, with usable references and tests for create, update, idempotency, dump, delete, and sync semantics.

Written by the indexing model from the issue text.