Add a scope serializer to `tranquil-scopes` #675

Why? #

The existing tranquil-scopes handles parsing scopes effectively, but it doesn't support serialization. This makes it difficult to reliably compare scope strings, or to create strong types for them. Adding a serializer will allow us to parse and compare scopes reliably.

Goals #

1. Unification: Right now we're using format!("repo:{}?action={}", ...) in a couple of places, and we have String typed scopes all across the OAuth system. The serializer would unify the implementation so we only have to manage scopes in one crate.
2. Determinism: actions is a HashSet so it can emit actions in a fixed order to prevent the scope value on a JWT from changing between checks. With a serializer, we can pin down a canonical ordering and format that guarantees this is never an issue.

If we do it right, this eliminates the typed representation of scopes is cheaper than Strings, and there are no footguns caused by stronger typing.