Make the token scopes POC production ready

[kopancek]

Based on the RFC definition:

• https://docs.google.com/document/d/1NYqCiVMCsnlOKlkWDHhnUeptN78_w3MQmlotYCrTzhE

We have an open PR with a POC for token scopes in the API:

• [DO NOT MERGE][feat] Add access token scopes authorization based on graphql directives #42284

To make the POC production ready, we need to work on several subtasks:

• Make the code more readable, understandable, better structured and following our conventions
• Use graph-gophers/graphql with support for graphql directives
• Add UI to be able to generate token with newly added scopes
• Add the directive to more entities in graphql and decide which scopes each entity should have
• Add proper tests and make sure it does not have a big performance hit on critical parts of the system
• Define a process for token scope conventions
• Add scope list to the schema, so only a specific list of scopes can be attached

/cc @sourcegraph/source/iam

[malomarrec]

Hey @kopancek, this issue didn't have a team label. Given you created it, I assigned you and added your team label. Feel free to unassign yourself. If this is not the right label, can you make sure to add the right one?