Fix Homebox OIDC invalid_scope error by allowing per-client extra scopes

_authelia_provision_oidc_client() hardcoded openid/profile/email as the
only scopes a registered client could ever request, but Homebox's own
Authelia integration needs 'groups' too — requesting it without it being
in the client's own scopes allowlist made Authelia reject every login
with invalid_scope, even though the server supports 'groups' generally.

Add an EXTRA_SCOPES positional arg (space-separated, right after
REQUIRE_PKCE) that only Homebox's caller populates ("groups"); every
other existing caller passes "" and gets a byte-for-byte unchanged
client registration.

services/mealie.sh

@@ -259,7 +259,7 @@ _mealie_offer_authelia_oidc() {
     prompt_yn "  Require two-factor for Mealie logins via Authelia too? (y/n):" "y" _2fa
     [[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor"
 
-    if ! _authelia_provision_oidc_client "Mealie" "mealie" "$AUTH_POLICY" "y" "n" "${BASE_URL}/login"; then
+    if ! _authelia_provision_oidc_client "Mealie" "mealie" "$AUTH_POLICY" "y" "n" "" "${BASE_URL}/login"; then
         log_warning "Couldn't register Mealie as an OIDC client in Authelia — skipping SSO setup."
         return 0
     fi