Allow targeted API access for ai_workflows scope

What does this MR do and why?

Allows access to specific endpoints with the ai_workflows scope

#478642 (closed)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

1. In rails console enable the Duo Workflow feature flag

   Feature.enable(:duo_workflow)

2. Invoke the class to generate an oauth token with the ai_workflow scope

   Ai::DuoWorkflows::CreateOauthAccessTokenService.new(current_user: User.first).execute

3. This token can be used to authenticate various endpoints. For example:

    curl --header "Authorization: Bearer $TOKEN_FROM_LAST_STEP" --url "https://gdk.test/api/v4/ai/duo_workflows/direct_access"