feat: add multi-scope support to API keys (#19917)

# Canonicalize API Key Scopes

This PR introduces canonical API key scopes with a `coder:` namespace prefix to avoid collisions with low-level resource:action names. It:

1. Renames special API key scopes in the database:
   - `all` → `coder:all`
   - `application_connect` → `coder:application_connect`

2. Adds support for a new `scopes` field in the API key creation request, allowing multiple scopes to be specified while maintaining backward compatibility with the singular `scope` field.

3. Updates the API documentation to reflect these changes, including the new endpoint for listing public API key scopes.

4. Ensures backward compatibility by mapping between legacy and canonical scope names in relevant code paths.

coderd/rbac/scopes.go

@@ -61,8 +61,8 @@ func WorkspaceAgentScope(params WorkspaceAgentScopeParams) Scope {
 }
 
 const (
-	ScopeAll                ScopeName = "all"
-	ScopeApplicationConnect ScopeName = "application_connect"
+	ScopeAll                ScopeName = "coder:all"
+	ScopeApplicationConnect ScopeName = "coder:application_connect"
 	ScopeNoUserData         ScopeName = "no_user_data"
 )
 

coderd/rbac/scopes_catalog.go

@@ -57,7 +57,8 @@ var externalLowLevel = map[ScopeName]struct{}{
 // low-level resource:action scopes.
 func IsExternalScope(name ScopeName) bool {
 	switch name {
-	case ScopeAll, ScopeApplicationConnect:
+	// Include `all` and `application_connect` for backward compatibility.
+	case "all", ScopeAll, "application_connect", ScopeApplicationConnect:
 		return true
 	}
 	if _, ok := externalLowLevel[name]; ok {

coderd/rbac/scopes_constants_gen.go

@@ -153,8 +153,8 @@ const (
 // ensure changes in rbac/scopes.go remain in sync here.
 func (e ScopeName) Valid() bool {
 	switch e {
-	case ScopeName("all"),
-		ScopeName("application_connect"),
+	case ScopeName("coder:all"),
+		ScopeName("coder:application_connect"),
 		ScopeName("no_user_data"),
 		ScopeAibridgeInterceptionCreate,
 		ScopeAibridgeInterceptionRead,
@@ -303,8 +303,8 @@ func (e ScopeName) Valid() bool {
 // including builtin and generated low-level scopes.
 func AllScopeNameValues() []ScopeName {
 	return []ScopeName{
-		ScopeName("all"),
-		ScopeName("application_connect"),
+		ScopeName("coder:all"),
+		ScopeName("coder:application_connect"),
 		ScopeName("no_user_data"),
 		ScopeAibridgeInterceptionCreate,
 		ScopeAibridgeInterceptionRead,