feat(openzaak): least-privilege client scopes (WP-57)

setup_configuration has no YAML field for granular autorisaties, so
bigregister-test now starts at heeft_alle_autorisaties: false (dev + prod
template) and bootstrap-catalogus.sh grants exactly the ztc/zrc scopes the
harness needs via the Django ORM, sidestepping the zero-scope
chicken-and-egg with the JWT-authenticated Autorisaties REST API.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/setup_configuration/data.yaml

@@ -2,9 +2,12 @@
 # documented CLI config mechanism — see docker-compose.openzaak.yml) instead of the Django
 # admin. Creates the ONE application the bootstrap script + integration test authenticate as.
 #
-# ponytail: heeft_alle_autorisaties (all scopes) rather than a granular per-component/scope
-# list — this instance only ever exists for this harness/test, never a shared or prod
-# OpenZaak, so there's no least-privilege boundary worth modeling here.
+# heeft_alle_autorisaties is false (WP-57, least privilege) — but
+# `ApplicatieConfigurationModel` (vng_api_common's setup_configuration step) has no field for
+# granular `autorisaties` at all, only this boolean. So this client starts with ZERO scopes;
+# bootstrap-catalogus.sh grants the exact ones it needs via `manage.py shell` (Django ORM,
+# not the JWT-authenticated Autorisaties REST API — a zero-scope client can't grant itself
+# anything over REST, so this sidesteps that bootstrap chicken-and-egg entirely).
 sites_config_enable: true
 sites_config:
   items:
@@ -24,4 +27,4 @@ vng_api_common_applicaties:
       client_ids:
         - bigregister-test
       label: BIG-register BFF (WP-54 test harness)
-      heeft_alle_autorisaties: true
+      heeft_alle_autorisaties: false