Improve OAuth2 Device Authorization consent handling for missing scopes

[therepanic]

There are two related issues in the OAuth2 Device Authorization flow when no scopes are requested.

The first issue is that when a device_authorization request is made without a scope, everything works fine, but when both authorities and scope are empty, an error is thrown that does not comply with Section 3.3 of RFC-6749. The second issue is that the error itself is reported as a client_id error rather than a scope error. Therefore, we need to resolve these two issues.

• Fix device authorization flow without requested scopes #19257
• Use SCOPE instead of CLIENT_ID for access_denied in device authorization consent #19258

[therepanic]

Inspiration: #19238