Merge Entra ID `roles` and OIDC `scp` Claims for Authorisation

FDS currently authorises users based on the scp (or scope) claim extracted from the Identity Provider's JWT. While this works perfectly for standard OIDC providers like Keycloak (which maps user roles directly into the scope string), Microsoft Entra ID separates these concepts, placing application roles into a separate roles list.
To support Entra ID without requiring code changes in every downstream service relying on AuthenticatedUser, the Auth Layer (app/auth/security.py) needs to be updated.

Acceptance Criteria:

• Update JWT validation to extract both the scp string and the roles list.
• Merge these values into a single, unified set of Effective Scopes.
• Ensure the existing TRUSTED_IDPS explicit scope stripping mechanism filters this combined set correctly.

Governing ADR(s): ADR 0006, ADR 0007

Migrated from the internal tracker, where it was #1, opened 2026-02-25.

Start in app/auth/security.py and read ADR 0006 and ADR 0007 for the authentication and trust model. Trace JWT validation and the TRUSTED_IDPS scope-stripping path, then verify that scp and roles form one Effective Scopes set and that explicit stripping applies to the combined values.