Merge commit from fork

* fix: add `Scopes` to `Request` interface so that scopes can be validated on all requests

* feat: assert org from scope exists when authorizing requests

* fix: check all scopes

* comments

* check org on callback creation

* fix tests

* clarifications

* fix scope marshaling

* fix: enfore organization for authrequest in initiation

* fix: filter sessions on the accounts page by organization scope

* add integration tests

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>

internal/repository/deviceauth/device_auth.go

@@ -29,6 +29,7 @@ type AddedEvent struct {
 	Audience         []string
 	State            domain.DeviceAuthState
 	NeedRefreshToken bool
+	OrganizationID   string
 }
 
 func (e *AddedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
@@ -53,6 +54,7 @@ func NewAddedEvent(
 	scopes []string,
 	audience []string,
 	needRefreshToken bool,
+	organizationID string,
 ) *AddedEvent {
 	return &AddedEvent{
 		eventstore.NewBaseEventForPush(
@@ -60,6 +62,7 @@ func NewAddedEvent(
 		),
 		clientID, deviceCode, userCode, expires, scopes, audience,
 		domain.DeviceAuthStateInitiated, needRefreshToken,
+		organizationID,
 	}
 }