OIDC with Entra ID cannot be set up due to AADSTS1002012

### Describe the bug

It is not possible to enter/check OIDC settings for Entra ID successfully via the admin UI.

Error message:
"Unexpected response from token endpoint (HTTP 400): AADSTS1002012: The provided value for scope openid is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI). Trace ID: 2da7d0ed-dae2-4fac-95ab-a28643252c00 Correlation ID: ae925c45-bddf-4bc5-9e98-035fa0610a0c Timestamp: 2026-09-17 17:34:43Z"

Metabase 1.63.18

### To Reproduce

1. Go to /admin/settings/authentication/oidc
2. Enter Entra ID client settings
3. Click on check or save

### Expected behavior

Check succeeds & does not block saving the settings

### Logs

```
2026-09-17T19:50:50+02:00 INFO metabase.sso.oidc.discovery Fetching OIDC discovery document from https://login.microsoftonline.com/x-x-x-x-x/v2.0/.well-known/openid-configuration
2026-09-17T19:50:50+02:00 INFO metabase.sso.oidc.discovery Invalidated discovery cache for issuer https://login.microsoftonline.com/x-x-x-x-x/v2.0
2026-09-17T19:50:50+02:00 DEBUG metabase.server.middleware.log POST /api/ee/sso/oidc/check 400 225ms (0 DB calls) {:metabase-user-id 7}
```

### Information about your Metabase installation

```JSON
{
"browser-info": {
"language": "en",
"platform": "MacIntel",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36",
"vendor": "Google Inc."
},
"metabase-info": {
"databases": [
"postgres",
"sqlite"
],
"run-mode": "prod",
"plan-alias": "pro-self-hosted-yearly",
"version": {
"date": "2026-09-15",
"tag": "v1.63.18",
"hash": "2ba2485"
},
"settings": {
"report-timezone": "Europe/Vienna"
},
"hosting-env": "unknown",
"application-database": "postgres",
"application-database-details": {
"database": {
"name": "PostgreSQL",
"version": "16.13"
},
"jdbc-driver": {
"name": "PostgreSQL JDBC Driver",
"version": "42.7.12"
}
}
},
"system-info": {
"file.encoding": "UTF-8",
"java.runtime.name": "OpenJDK Runtime Environment",
"java.runtime.version": "25.0.4+7-LTS",
"java.vendor": "Eclipse Adoptium",
"java.vendor.url": "https://adoptium.net/",
"java.version": "25.0.4",
"java.vm.name": "OpenJDK 64-Bit Server VM",
"java.vm.version": "25.0.4+7-LTS",
"jvm.available-processors": 2,
"jvm.max-memory": "750.0 MB",
"os.name": "Linux",
"os.version": "6.12.90-120.164.amzn2023.x86_64",
"system.total-memory": "2.9 GB",
"user.language": "en",
"user.timezone": "Europe/Vienna"
}
}
```

### Severity

Blocking

### Additional context

We are in trial period and this feature is essential for us to work - the reason we purchase the Pro license.

Start at the /api/ee/sso/oidc/check endpoint and follow the OIDC discovery flow indicated by the metabase.sso.oidc.discovery logs. Reproduce the check with Entra ID settings, inspect how the token request scope is formed, and confirm that checking and saving the settings succeed without AADSTS1002012.

Written by the indexing model from the issue text.