💡 feat: allow granting GraphQL access via `bk auth login`

### Is your feature request related to a problem?

I use the bk CLI to power a few simple local dashboards. Some of these use GraphQL queries. It's convenient to defer as much of the finicky stuff about authentication/managing tokens, connecting to organisations, constructing requests etc. to the official CLI... but it seems like the normal `bk auth login` path to authenticate doesn't allow granting GraphQL access.

### Describe the solution you'd like.

Some method to grant access to GraphQL to the token provisioned by `bk auth login`.

For example: additional elements for `--scopes`, or an additional flag `bk auth login --graphql=none/read/full` mirroring https://buildkite.com/user/api-access-tokens/new

### Describe alternatives you've considered.

It seems a workaround is manually making a token through the UI, and passing it to `bk auth login --org=... --token=...`. This feels clunky and requires me to manage long-lived tokens manually, rotating them as appropriate.

### Additional context

_No response_