feat(auth): request Basilisk query scope

[tdejager]

Description

pixi audit will use prefix.dev access tokens to query Basilisk. Rattler's built-in prefix.dev client currently asks for identity and channel scopes only, so those tokens cannot call the authenticated query API.

This adds basilisk:query to the shared prefix.dev OAuth defaults used by the authorization-code and device-code flows without dropping the existing channel scopes. Refresh requests continue to omit scope, which preserves the original grant. Users with an existing login will need to upgrade to a Pixi release containing this change, then log out and back in.

PFX-1798

How Has This Been Tested?

• Formatting and workspace Clippy pass.
• Focused auth tests cover the complete prefix.dev default scope set.
• Refresh tests assert that refresh requests do not replace the original grant.

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.

Tools: OpenAI Codex via pi

Add basilisk:query to prefix.dev's shared OAuth defaults, preserve the existing channel grant during refresh, cover the auth flows, add re-login guidance, and validate the change.

Checklist

• I have performed a self-review of my own code
• I have commented the refresh behavior where it is easy to regress
• I have made corresponding changes to the documentation
• I have added sufficient tests to cover my changes

[baszalmstra]

this can be removed its auto generated