Scope source for the request transformer

[guardrex]

Fixes #36301

Tom, Wade ... I just need one review to get this in.

This will improve the article to match updates made to the BWA+Entra+BFF sample apps (9.0 and 10.0) that I made as part of placing new 10.0 samples this morning. Specifically ...

• The original sample was a bit scatter-🧠 in that the request transformer was reading the scopes from configuration instead of hardcoding them into the Program file. [Note: Halter specifically wants hardcoded security config for the base case sample.] I updated the samples to read the scopes from a List<string> in the Program file to match how other security config is established. This PR mirrors the sample update in the article with an added instruction on configuring the server project with the scope(s).
• There's an existing section later in the article that explains how to switch over to app settings configuration (Halter was fine making it a section in the article to explain the setup, which I'm sure devs get good use out of). This PR also adds a bit on how to do that for the request transformer's scopes.

Note in passing that Copilot is asking for more context, but this is an advanced article for advanced devs. We don't need to bog down the article with what Copilot is asking for. Besides, this article will be up for more work in '26 if I can get time to work on the Blazor security node next year. I might flesh out some of this with additional remarks ... but not now ... I'm 🏃‍♂️😅 to get everything in place for 10.0 GA.

---

Internal previews

📄 File	🔗 Preview link
.github/workflows/blazor-hybrid-issue-processing.yml	.github/workflows/blazor-hybrid-issue-processing
.github/workflows/blazor-issue-processing.yml	.github/workflows/blazor-issue-processing
aspnetcore/blazor/security/blazor-web-app-with-entra.md	aspnetcore/blazor/security/blazor-web-app-with-entra

[Copilot]

Pull Request Overview

This PR adds documentation for providing downstream API scopes to the request transformer in a Blazor Web App with Microsoft Entra ID authentication, specifically for the BFF (Backend for Frontend) pattern implementation.

[wadepickett]

Approved.