## Description

A registry-bound IdP can declare a non-default **`scope_claim_name`**
(e.g. `scp` for Entra/Azure AD, `roles`). Until now the gateway resolved
the scope claim name only from the API def / OAS, defaulting to
`"scope"`. So a registry-only API whose IdP emits scopes under a
non-`scope` claim — with no manual scope config — would `403` (`no
matching policy found`) because the gateway read the wrong claim.

This wires the dashboard's new `scope_claim_name` field
(TykTechnologies/tyk-analytics#5788) through the gateway registry so
it's actually consumed.

## Changes

- **`IdP`** gains `ScopeClaimName` (`json:"scope_claim_name"`),
mirroring the dashboard `model.ClientIdP` and the MDCB model
(tyk-sink#794). Picked up automatically on both feeds (Dashboard
envelope + RPC `unmarshalIdPs`) — no transport change.
- **`Binding`** denormalises it from the IdP at `rebuild` time, so the
JWT hot path needs no second registry lookup (same approach already used
for `ScopeToPolicy`).
- **`scopeClaimNameForRequest`** resolves with **manual-wins
precedence**: Classic `GetScopeClaimName` / OAS → registry binding →
`"scope"`. The fallback only fires when the API def sets nothing, so
manual-config APIs stay byte-identical.

## Cross-repo

| Repo | PR | Field |
|------|----|----|
| tyk-analytics (dashboard) | #5788 | `model.ClientIdP.ScopeClaimName` |
| tyk-sink (MDCB) | #794 | `models.ClientIdP.ScopeClaimName` |
| tyk (gateway) | this PR | `IdP.ScopeClaimName` |

Verified end-to-end: the MDCB RPC read path (`LoadClientIdPs` →
`filterAndPruneClientIdPs` → `pruneIdP`) uses full-document loads and
shallow struct copies, so the field is carried through with no
projection dropping it.

## How this has been tested

New tests (TDD, race-clean):
- `TestIdPRegistry_RebuildCarriesScopeClaimName` — propagation into the
binding.
- `TestScopeClaimNameForRequest` — the three-tier resolution order
(manual wins → binding → default).
- `TestIdPRegistry_JWT_ResolvesScopeClaimNameFromRegistry` — end-to-end:
token with scopes under `scp`, no manual scope claim → 200.
- `TestIdPRegistry_JWT_NoScopeClaimNameRejects` — counterpart proving
the same setup with no IdP `scope_claim_name` falls through to `"scope"`
and 403s, pinning down that the registry fallback is what flips the
result.

## Types of changes

- [x] New feature (non-breaking change which adds functionality)