`parseScope` only looked for `:` to find the resource prefix, so valid canonical scopes using the `prefix?query` form (e.g. a multi-collection `repo?collection=a&collection=b` produced by expanding a permission set) were rejected as `Unknown scope resource`. Use the earlier of `:` and `?` as the delimiter, matching `@atproto/oauth-scopes` syntax.