Support defining SCIM token via config file

Nobody has claimed this yet.

**What problem will this feature request solve?**

Currently, enabling SCIM is a 2-step process:

1. Go to Admin > Authentication > User provisioning > Enable SCIM (or, set `scim-enabled: true` in the config file)
2. Generate and save a SCIM token

Step 2 always requires a manual click or API call. There is no config file preference or environment variable to define the SCIM token.

It's currently possible to define API keys in the config file like so:

```yaml
config:
api-keys:
- name: My API key
group: admin
creator: foo@example.com
key: mb_thisismyapikey
```

However this cannot be used for SCIM tokens specifically. SCIM tokens are stored in the `api_key` table, with a value of `scim` in the `scope` column. This cannot be passed via config file.

**Describe the solution you'd like.**

Allow some way of defining SCIM tokens via config file. Example:

```yaml
config:
scim-enabled: true
api-keys:
- name: My SCIM token
creator: foo@example.com
scope: scim
key: mb_thisismyscimtoken
```

**How does this feature request impact you?**

Inconvenient for fully-automated/replicated setups. Config file feels incomplete when it cannot be used to fully enable SCIM.

Start with the existing config.api-keys handling and api_key table persistence, then compare how scim-enabled and the scim API-key scope are processed. Done means a SCIM token can be defined in the config file for automated setups, with behavior covered by the relevant configuration and token tests.

Written by the indexing model from the issue text.