AC: align scopes with recent ABAC and Entitlements changes #145

Scope requirements were a flat list of names combined by a SpEL expression, which made them
inconsistent with entitlements — where @AccessControlEntitlements already declares
@EntitlementsGroup clauses combined by an explicit mode. That asymmetry meant two different
mental models for what is fundamentally the same kind of rule, and the SpEL escape hatch was
re-parsed on every request while offering no type safety and dragging in a
spring-expression dependency that non-Spring users still had to carry.

Restructure scopes to mirror entitlements: @AccessControlScopes becomes a container of
@ScopesGroup clauses combined by mode(), giving the same two levels of quantification —
clauses over scope names, and the container over clauses. Scope clauses default to ALL_OF
(a caller normally needs every scope listed), where entitlement clauses default to ANY_OF.

SpEL and the spring-expression dependency are removed outright. Rules that genuinely need
arbitrary logic — anything deeper than two levels, or that weighs scopes together with the
operation, the resource or the caller — belong in an @AccessControlPolicy, which is
ordinary code with no structural limit and can read the granted scopes from the context.

Breaking change: existing SpEL-based scope declarations must be rewritten as clauses or as a
policy.