OAuth M2M fails with scoped secrets because all-apis is always requested

Start with NewAuthenticatorWithScopes and GetScopes, where the issue reports that all-apis is appended unconditionally. Reproduce the scoped-secret flow with the provided SQL scope and verify that a nonempty caller-provided scope reaches the token request without requiring all-apis; confirm that the SQL connection succeeds.

Hi team! We are having trouble with service principal authentication following the introduction of scoped OAuth secrets. The M2M authenticator in databricks-sql-go unconditionally requests all-apis, but all-apis is no longer the default in the UI.

Steps to reproduce

1. Create a Databricks service principal with access to a SQL warehouse.
2. Generate an OAuth secret restricted to the sql scope.
3. Verify the credential directly:

curl --request POST \
  --url "https://<workspace-host>/oidc/v1/token" \
  --user "<client-id>:<client-secret>" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=sql"

This succeeds and returns a token with scope sql.

4. Connect using the Go driver's M2M authenticator:

authenticator := m2m.NewAuthenticator(
	clientID,
	clientSecret,
	workspaceHost,
)

connector, err := dbsql.NewConnector(
	dbsql.WithServerHostname(workspaceHost),
	dbsql.WithPort(443),
	dbsql.WithHTTPPath(warehouseHTTPPath),
	dbsql.WithAuthenticator(authenticator),
)
if err != nil {
	return err
}

db := sql.OpenDB(connector)
defer db.Close()

var result int
err = db.QueryRowContext(context.Background(), "SELECT 1").Scan(&result)

The connection fails before opening the SQL session:

oauth2: "access_denied" "Scopes 'all-apis' are not assigned to the client <redacted>"

Root cause

NewAuthenticatorWithScopes calls GetScopes, which always appends all-apis:

func GetScopes(hostName string, scopes []string) []string {
	if !oauth.HasScope(scopes, "all-apis") {
		scopes = append(scopes, "all-apis")
	}
	return scopes
}

The code comments say the behavior matches the underlying kernel unconditionally requiring all-apis.

Suggested fix: Investigate whether NewAuthenticatorWithScopes can pass through nonempty caller-provided scopes.

Thank you!