swarm-queue-client: request the bearer-authz scope when minting an agent token

`swarm-logs query` got a bare nginx 401 from the swarm log store on every
query. The agent OIDC client is registered for `authelia.bearer.authz`
(`swarm-authelia.nix`'s `agentClients` sets `bearerAuthz`), but registration
is not issuance: the token request asked for no scope, so the token came back
carrying none, and authelia's `/api/authz/auth-request` refuses that exactly
as it refuses an unauthenticated caller.

The same failure is already recorded in `swarm-otel.nix` against the
collector's client, on the same scope string — prometheus asks for no scopes
unless told to, and every scrape was refused at introspection. This is that
bug one layer down, so it gets the same shape of fix.

`scope` becomes an opt-in parameter alongside `audience`, not a hardcoded
value or a config field: the two travel together (registered ≠ requested
applies to both) and only the destination decides whether either is needed.
`None` keeps every other caller byte-identical — the NATS connect callback,
`auth.rs`'s bridge client and the OTLP push client all pass it.

Refs #4464

swarm-logs/README.md

@@ -50,6 +50,11 @@ hold `authelia.bearer.authz`. Both are set in `swarm-authelia.nix`'s
 `agentClients`; without them authelia answers `invalid_target` at the token
 endpoint, or the gateway answers 401 with no explanation.
 
+⚠️ Registration is not issuance, so the token request _asks_ for both: the
+audience and the scope are named in the `client_credentials` form, because a
+client that is registered for a scope it does not request is handed a token
+carrying none, and the gateway refuses that with the same bare 401.
+
 ## Configuration
 
 Supplied by `nix/agent-modules/logs.nix`, which wraps the binary — the same