Derive ARM auth scopes from endpoint URL

[cataggar]

Problem

ARM TypeSpec specs declare OAuth2 with relative scopes like user_impersonation. The emitter passes this bare scope verbatim to BearerTokenAuthorizationPolicy::new(). When Azure CLI or other identity libraries try to acquire a token for just user_impersonation, it resolves to Microsoft Graph (00000003-0000-0000-c000-000000000000) instead of Azure Management, causing authentication failures:

AADSTS65002: Consent between first party application '04b07795-...'
and first party resource '00000003-...' must be configured via preauthorization

Fix

When scopes are relative (not absolute URLs), generate code that derives the scope from the endpoint origin at runtime using the standard Azure SDK pattern: {endpoint_origin}/.default.

Before (broken):

BearerTokenAuthorizationPolicy::new(credential, vec!["user_impersonation"])

After (fixed):

BearerTokenAuthorizationPolicy::new(
    credential,
    vec![format!("{}/.default", endpoint.origin().ascii_serialization())],
)

Absolute scopes (e.g. https://vault.azure.net/.default used by data-plane services) are still emitted as static strings.

This is consistent with other Azure SDK languages (Python uses f"{base_url}/.default", Go uses cloud.Services[ResourceManager].Audience + "/.default").

Validation

• All 32 emitter tests pass
• Regenerated test crates compile successfully
• Tested live against Azure VMware Solution API (Add azure_resourcemanager_vmware crate azure-sdk-for-rust#4095)