[#1103] Add upgrade step syncing missing ScriptingService sub-configurations

[vharseko]

Summary

Fixes #1103.

PR #1034 (16.1.1) introduced the OAUTH2_ACCESS_TOKEN_MODIFICATION script context and its default global script in the <Configuration> section of scripting.xml. The SMS only registers that section when the whole service is new, and the upgrade framework (UpgradeServiceSchemaStep → ServiceSchemaModifications) diffs <Schema> only. As a result, instances upgraded from a version that already contained the Scripting Service (e.g. 16.0.6 → 16.1.1) are left without:

• the scriptContext=OAUTH2_ACCESS_TOKEN_MODIFICATION sub-configuration (incl. its engineConfiguration whitelist),
• the globalScripts/d22f9a0c-426a-4466-b95e-d0f125b0d5fa default global script,
• the new context choice values in the ScriptingService schema (attribute modifications are only applied when an UpgradeHelper is registered for the service, and ScriptingService had none).

Meanwhile the new OAuth2 Provider attribute forgerock-oauth2-provider-access-token-modification-script is added on upgrade (via OAuth2ProviderUpgradeHelper) with its default pointing at the missing script. Reading /json/global-config/services?_action=nextdescendents then fails single_choice validation (ScriptChoiceValues finds no script of that context) and the whole Global Services page returns 500.

Changes

• UpgradeScriptingSubConfigsStep (new, depends on UpgradeServiceSchemaStep): reads the tag-swapped bundled scripting.xml via UpgradeServiceUtils.getServiceDefinitions, recursively compares its <GlobalConfiguration> sub-configurations with the Scripting Service global config in the data store, and creates any missing ones. Existing sub-configurations are left untouched (user-tuned engine whitelists are not overwritten). The generic diff also self-heals installations already upgraded to 16.1.1/16.1.2 on their next upgrade, and automatically covers any script contexts added in future versions. Follows the UpgradeEntitlementSubConfigsStep pattern.
• ScriptingServiceHelper (new, registered in serverupgrade.properties): syncs the script context choice values of defaultScriptContext and scriptConfiguration.context with the service definition.
• UpgradeServiceUtils.getServiceDefinitions widened to public so the step in the steps.scripting sub-package can reuse it.
• New report keys in amUpgrade.properties.

Creation order is safe: the defaultScript attribute of scriptContext validates against the ScriptConstants.GlobalScript enum (GlobalOnly=true), not against the data store.

Testing

mvn -o -pl openam-upgrade test
# Tests run: 126, Failures: 0, Errors: 0, Skipped: 0 — BUILD SUCCESS

Includes the new UpgradeScriptingSubConfigsStepTest (+ test-scripting.xml resource) verifying that a missing script context (with engine configuration) and a missing default global script are created with the expected attributes, and that the step is not applicable when everything is already configured. The generated upgradesteps.properties orders the new step after UpgradeServiceSchemaStep and ScriptingSchemaStep.