Merge commit from fork

* fix: add `Scopes` to `Request` interface so that scopes can be validated on all requests

* feat: assert org from scope exists when authorizing requests

* fix: check all scopes

* comments

* check org on callback creation

* fix tests

* clarifications

* fix scope marshaling

* fix: enfore organization for authrequest in initiation

* fix: filter sessions on the accounts page by organization scope

* add integration tests

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>

internal/query/device_auth_test.go

@@ -52,15 +52,15 @@ var (
 		"appName",
 		"projectName",
 	}
-	expectedDeviceAuth = &domain.AuthRequestDevice{
-		ClientID:    "client-id",
-		DeviceCode:  "device1",
-		UserCode:    "user-code",
-		Scopes:      []string{"a", "b", "c"},
-		Audience:    []string{"projectID", "clientID"},
-		AppName:     "appName",
-		ProjectName: "projectName",
-	}
+	expectedDeviceAuth = domain.NewAuthRequestDevice(
+		"client-id",
+		"device1",
+		"user-code",
+		[]string{"a", "b", "c"},
+		[]string{"projectID", "clientID"},
+		"appName",
+		"projectName",
+	)
 )
 
 func TestQueries_DeviceAuthRequestByUserCode(t *testing.T) {