Function validate_scopes 

pub fn validate_scopes(scope_str: &str) -> Result<Vec<String>, AuthError>

Parse and validate a space-separated scope string.

Rules:

• openid must be present (this is an OIDC provider).
• All scopes must be in SUPPORTED_SCOPES.

Returns the validated scopes as a Vec<String>.