[codex] Add Actions Datastore OAuth scopes

[sdkennedy2]

Summary

• Allow pup auth login --scopes to accept Actions Datastore OAuth scopes.
• Keep the scopes out of the default login scope set until the Datadog OAuth server exposes them.

Why

pup previously filtered apps_datastore_read as an unknown scope before the OAuth request. That prevented testing Actions Datastore API OAuth access from the CLI.

Validation

• cargo test --bin pup auth::types::tests
• cargo fmt --check
• cargo clippy --bin pup -- -D warnings
• target/debug/pup auth login --scopes apps_datastore_read --callback-port 9000 now requests apps_datastore_read; the live OAuth server still returns invalid_scope, confirming the remaining blocker is server-side scope registration.