Add explicit scope to authorization request

[amartinz]

Clear and concise description of the problem

When connecting to Forgejo (e.g.: Codeberg) it is impossible to create an OAuth2 application which only allows a specific scope (as reference see this issue).

This results in requesting broad access to everything, read and write.

Suggested solution

Scope the access to specifically what is needed, like read:user and read:repository.

This can be achieved with appending &scope=read:user,read:repository to the authorization URL.

Alternative

No response

Additional context

No response

Validations

• Checked that the feature isn't part of the next version already [https://woodpecker-ci.org/versions]
• Read the docs.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.

[qwerty287]

Forgejo doesn't support this, right?

[amartinz]

Yes, Forgejo does not have the UI to show this, but woodpecker can also scope explicitly with providing the scope at the authorization request.

Only requesting what's needed would safeguard against being able to do too much with the obtained token, too, if the OAuth2 application would be configured with a too broad scope by mistake (once Forgejo implements that).