auth: application credentials should not send a scope in token requests #3868

Bug

When authenticating with application credentials, ToTokenV3ScopeMap still builds and returns a project scope from AuthScope (or from the TenantID/TenantName backwards-compatibility fallback). Keystone rejects this with HTTP 401:

Application credentials cannot request a scope.

This is because application credentials carry an implicit project scope baked into the credential at creation time. Sending an explicit scope alongside them is an error per the Keystone spec.

Keystone source reference

https://opendev.org/openstack/keystone/src/branch/stable/2025.1/keystone/auth/plugins/application_credential.py

The plugin raises ApplicationCredentialAuthError when a scope is provided alongside application credentials.

Expected behaviour

ToTokenV3ScopeMap should return an empty map when ApplicationCredentialID or ApplicationCredentialName is set, so that no scope key is included in the token request body.

Proposed fix

Add an early-return guard at the top of ToTokenV3ScopeMap:

if opts.ApplicationCredentialID != "" || opts.ApplicationCredentialName != "" {
    return map[string]any{}, nil
}

This mirrors the behaviour of the existing unit tests in openstack/identity/v3/tokens/testing/requests_test.go (e.g. TestCreateApplicationCredentialIDAndSecret) which already pass nil scope and expect no scope in the JSON body — but those tests use tokens.AuthOptions, not gophercloud.AuthOptions, so the bug only surfaces when the top-level AuthOptions is used with a populated Scope field or TenantID/TenantName.