sec(auth): AccountScope.Allows grants every account that shares an allowed display name #433

AccountScope.Allows(accountID, accountName) (internal/auth/account_scope.go:104) matches a scope entry against either the account ID or the display name. Display names are not unique, so a group scoped to the name of one account is also granted every other account that uses the same name, including one created later in another provider or tenant. This is pre-existing and not widened by #381, which reuses the same matcher.

Fix options: scope entries match account IDs only (with a migration mapping existing name entries to IDs), or reject/flag scopes whose names are ambiguous. Add a test with two accounts sharing a display name where only one is intended to be in scope.

Found while reviewing #381 (issue #92).