fix(cli): fix OAuth provider scopes and attribute mappings in generate

[9pace]

Summary

• Fix scope field name typo: authorized_scopes → authorize_scopes (Cognito's actual field name)
• Remove incorrect VALID_SCOPES filter that mangled provider scopes (e.g. Facebook's public_profile → profile)
• Route non-standard attribute mapping keys (e.g. username → sub/id) into custom sub-object instead of dropping them

Before (generated resource.ts)

google: {
  clientId: secret('GOOGLE_CLIENT_ID'),
  clientSecret: secret('GOOGLE_CLIENT_SECRET'),
  attributeMapping: {
    email: 'email',
  },
},
facebook: {
  clientId: secret('FACEBOOK_CLIENT_ID'),
  clientSecret: secret('FACEBOOK_CLIENT_SECRET'),
  attributeMapping: {
    email: 'email',
  },
},

Scopes missing entirely. username → sub/id mapping dropped.

After (generated resource.ts)

google: {
  clientId: secret('GOOGLE_CLIENT_ID'),
  clientSecret: secret('GOOGLE_CLIENT_SECRET'),
  scopes: ['openid', 'email', 'profile'],
  attributeMapping: {
    email: 'email',
    custom: {
      username: 'sub',
    },
  },
},
facebook: {
  clientId: secret('FACEBOOK_CLIENT_ID'),
  clientSecret: secret('FACEBOOK_CLIENT_SECRET'),
  scopes: ['email', 'public_profile'],
  attributeMapping: {
    email: 'email',
    custom: {
      username: 'id',
    },
  },
},

Caveats

• Provider scopes are no longer validated — the old validation was against the wrong namespace (Cognito OAuth scopes vs provider scopes), but there is now no validation at all
• OIDC/SAML providers flatten standard + custom attributes back into a single Record since their rendering path doesn't support the custom sub-object

Test plan

• Verified end-to-end with a test app using Google and Facebook social login: Gen2 deployed with correct scopes and attribute mappings without manual post-generate edits to OAuth config
• Run generate on existing migration test apps with social providers
• Verify OIDC/SAML provider rendering is unchanged