non-web clients can't specify additional oidc scopes

## Describe the bug

The iOS (and I assume android and desktop) clients don't respect the `WEB_OIDC_SCOPE` setting and don't have a way to set OIDC scopes for themselves. This is breaking login for me because I'm using an additional scope to setup claims that are used for role mapping.

## Steps to reproduce

Steps to reproduce the behavior:
1. Create a new scope in your idp called ocis which maps a new claim called ocisRole
2. Set PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM="ocisRole"
3. Try logging in via the iOS client

## Expected behavior
I would expect the non-web clients to auth in the same way that the web is configured or at least give me a way to configure them to auth appropriately.

## Actual behavior
The iOS client fails to login with an error that says "The operation couldn't be completed. (OCHTTPStatusErrorDomain error 500.)" and the OCIS server logs show:
```console
2023-07-14T17:08:17Z ERR No roles in user claims line=github.com/owncloud/ocis/v2/services/proxy/pkg/userroles/oidcroles.go:45 request-id=2314D889-BB84-4BFE-B9DD-B2E301E2D60A rolesClaim=ocisRole service=proxy userid=062b07d5-a1f7-420a-9460-9cc432339941
2023-07-14T17:08:17Z ERR Could not get user roles error="no roles in user claims" line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/account_resolver.go:107 service=proxy
```

## Setup
I have OCIS setup in a Kubernetes cluster running as a single service with Authentik as the identity provider.

k8s deployment yaml
```console
apiVersion: apps/v1
kind: Deployment
metadata:
name: ocis-server
namespace: cloud
labels:
app.kubernetes.io/name: server
app.kubernetes.io/instance: ocis
spec:
selector:
matchLabels:
app.kubernetes.io/name: server
app.kubernetes.io/instance: ocis
replicas: 1
strategy:
type: RollingUpdate
template:
metadata:
labels:
app.kubernetes.io/name: server
app.kubernetes.io/instance: ocis
spec:
automountServiceAccountToken: true
securityContext:
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
containers:
- name: ocis
image: "owncloud/ocis:3.1.0-next.3"
imagePullPolicy: IfNotPresent
command: ["ocis"]
args: ["server"]
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
readOnlyRootFilesystem: true
env:
- name: OCIS_LOG_LEVEL
value: "debug"
- name: OCIS_LOG_PRETTY
value: "true"
- name: OCIS_LOG_COLOR
value: "true"

- name: OCIS_EXCLUDE_RUN_SERVICES
value: "idp"

- name: OCIS_URL
value: "https://cloud.dev.lab.mydomain.com"
- name: OCIS_INSECURE
value: "false"
- name: OCIS_PERSISTENT_STORE
value: "redis"
- name: OCIS_PERSISTENT_STORE_NODES
value: "ocis-redis-master:6379"
- name: OCIS_JWT_SECRET
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: jwt-secret
- name: OCIS_TRANSFER_SECRET
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: transfer-secret
- name: OCIS_MACHINE_AUTH_API_KEY
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: machine-auth-api-key
- name: OCIS_SYSTEM_USER_API_KEY
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: api-key
- name: OCIS_SYSTEM_USER_ID
value: "df7da318-c4bf-476d-8bdc-80d86da99370"

- name: GATEWAY_STORAGE_USERS_MOUNT_ID
value: "df7da318-c4bf-476d-8bdc-80d86da99370"
- name: STORAGE_USERS_MOUNT_ID
value: "df7da318-c4bf-476d-8bdc-80d86da99370"

- name: GRAPH_APPLICATION_ID
value: "3a3eb3dd-7751-4c4b-a79b-3e154f5e7a6e"
- name: GRAPH_LDAP_BIND_PASSWORD
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: idm-reva-password

- name: GROUPS_LDAP_BIND_PASSWORD
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: idm-reva-password

- name: IDM_CREATE_DEMO_USERS
value: "false"
- name: IDM_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: idm-admin-password
- name: IDM_SVC_PASSWORD
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: idm-svc-password
- name: IDM_REVASVC_PASSWORD
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: idm-reva-password

- name: PROXY_DEBUG_ADDR
value: "0.0.0.0:9205"
- name: PROXY_AUTOPROVISION_ACCOUNTS
value: "true"
- name: PROXY_TLS
value: "false"
- name: PROXY_ROLE_ASSIGNMENT_DRIVER
value: "oidc"
- name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
value: "ocisRole"
- name: PROXY_OIDC_REWRITE_WELLKNOWN
value: "true"
- name: PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD
value: "none"
#value: "jwt" # non-web clients can't authenticate if this is set
- name: PROXY_USER_OIDC_CLAIM
value: "preferred_username" # https://github.com/owncloud/ocis/issues/1417
- name: PROXY_USER_CS3_CLAIM
value: "username"

- name: THUMBNAILS_TRANSFER_TOKEN
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: thumbnails-transfer-secret

- name: USERS_LDAP_BIND_PASSWORD
valueFrom:
secretKeyRef:
name: "ocis-secrets"
key: idm-reva-password

- name: WEB_OIDC_SCOPE
value: "openid profile email ocis"
- name: WEB_OPTION_DISABLE_FEEDBACK_LINK
value: "true"

- name: OCIS_OIDC_CLIENT_ID
value: "rpxotWdhDpx02JYqv6i5SagU1Xs1KKWS2eB6K5mw"
- name: OCIS_OIDC_ISSUER
value: "https://auth.dev.lab.mydomain.com/application/o/owncloud/"

livenessProbe:
httpGet:
path: /healthz
port: metrics-debug
timeoutSeconds: 10
initialDelaySeconds: 60
periodSeconds: 20
failureThreshold: 3
resources: {}
ports:
- name: http
containerPort: 9200
- name: metrics-debug
containerPort: 9205
volumeMounts:
- name: ocis-config-tmp
mountPath: /etc/ocis # we mount that volume only to apply fsGroup to that path
- name: ocis-data
mountPath: /var/lib/ocis
- name: tmp-volume
mountPath: /tmp
volumes:
- name: ocis-config-tmp
emptyDir: {}
- name: ocis-data
emptyDir: {}
- name: tmp-volume
emptyDir: {}
```

## Additional context
This is somewhat related to https://github.com/owncloud/ocis/issues/6479 in that the various non-web clients don't have configuration for how they do oauth.

Start by reviewing services/proxy/pkg/userroles/oidcroles.go:45 and services/proxy/pkg/middleware/account_resolver.go:107, then compare the non-web client behavior with WEB_OIDC_SCOPE and related issue 6479. Trace how OIDC scopes reach authentication and verify that an iOS login requesting the ocis scope supplies the ocisRole claim without breaking other clients.

Written by the indexing model from the issue text.