feat: add client-side security scope/role accessors

[schnell18]

Summary

This PR adds client-side accessor functions to programmatically retrieve required OAuth2 scopes and roles for operations, enabling proper token exchange flows with downstream APIs.

Problem

Currently, ogen generates server-side code with scope/role information, but client-side code has no way to programmatically determine which scopes are required for operations. This prevents clients from:

1. Requesting JWT tokens with the correct scope and audience when calling protected operations
2. Implementing proper OAuth2 token exchange flows (RFC 8693)
3. Building secure microservice architectures with scope-aware token management

Solution

Generate public accessor functions and private scope/role maps for client code, mirroring the server-side pattern:

For OAuth2 Security:

• GetOAuth2ScopesFor{SecurityName}(operation string) []string
• Private map: oauth2Scopes{SecurityName}

For Other Security (Bearer, Basic, etc.):

• GetRolesFor{SecurityName}(operation string) []string
• Private map: operationRoles{SecurityName}

When client and server code generation are enabled at the same time, the client will reuse the private map generated for server.