Fix Homebox OIDC invalid_scope error by allowing per-client extra scopes

_authelia_provision_oidc_client() hardcoded openid/profile/email as the
only scopes a registered client could ever request, but Homebox's own
Authelia integration needs 'groups' too — requesting it without it being
in the client's own scopes allowlist made Authelia reject every login
with invalid_scope, even though the server supports 'groups' generally.

Add an EXTRA_SCOPES positional arg (space-separated, right after
REQUIRE_PKCE) that only Homebox's caller populates ("groups"); every
other existing caller passes "" and gets a byte-for-byte unchanged
client registration.

services/actualbudget.sh

@@ -257,7 +257,7 @@ _actualbudget_offer_authelia_oidc() {
     prompt_yn "  Require two-factor for Actual Budget logins via Authelia too? (y/n):" "y" _2fa
     [[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor"
 
-    if ! _authelia_provision_oidc_client "ActualBudget" "actualbudget" "$AUTH_POLICY" "y" "n" \
+    if ! _authelia_provision_oidc_client "ActualBudget" "actualbudget" "$AUTH_POLICY" "y" "n" "" \
         "https://${AB_OIDC_DOMAIN}/openid/callback"; then
         log_warning "Couldn't register Actual Budget as an OIDC client in Authelia — skipping SSO setup."
         return 0