Scope metrics REST endpoint: resolve bindings by scope_type, execute presets with scope_id (instant/range)

GET /resource/scopes/{scope_type}/{scope_id}/metrics?range=&step=. Resolve the scope_type bindings, pass scope_id as id to each preset, execute via PrometheusClient.execute_preset (instant when range omitted; series when present). Response: { "": {"instant": , "series": [[ts,val],...]}, ... }. Gate on the scoped read-permission check.

Success Criteria:
- [ ] range omitted -> instant scalars for each seeded binding.
- [ ] range=1h&step=... -> series arrays for each binding.
- [ ] scope_id correctly bound as the id label in the executed preset.
- [ ] Unauthorized requester -> 403 (via the scoped permission check).
- [ ] Unknown scope_type -> 404/empty per contract.
- [ ] pants test passes for affected packages

JIRA Issue: BA-6755

Start at the GET /resource/scopes/{scope_type}/{scope_id}/metrics endpoint and trace scope_type binding resolution, the scoped read-permission check, and PrometheusClient.execute_preset. Verify omitted range returns instant scalars, range plus step returns series, and scope_id is passed as the preset id; finish by running the pants tests for affected packages.

Written by the indexing model from the issue text.