feat(seer): Add seer:read and seer:write scopes

[sebastianv1]

Summary

Developers who go through the autofix flow and want to modify the generated output for any of the steps (root cause, plan or code changes) now go through the Seer panel. As a result, when they prompt Seer it goes through the Sentry API and makes a POST request to autofix which requires the event:write scope by default for all AI endpoints.

This can be annoying to have to grant permission to the seer agent every 4 hours for something the seer agent logically should be able to write to (it's own output).

Changes

This adds seer:read & seer:write scope pair we can grant the agent and then the subsequent autofix run APIs so that the agent doesn't require permission from the user to run.

Test plan

[linear-code]

AIML-3633

[github-actions]

This PR has a migration; here is the generated SQL for src/sentry/hybridcloud/migrations/0044_add_seer_scopes.py src/sentry/migrations/1215_add_seer_scopes.py

for 0044_add_seer_scopes in hybridcloud

--
-- Alter field scopes on apikeyreplica
--
-- (no-op)
--
-- Alter field scopes on apitokenreplica
--
-- (no-op)

for 1215_add_seer_scopes in sentry

--
-- Alter field scopes on apiauthorization
--
-- (no-op)
--
-- Alter field scopes on apikey
--
-- (no-op)
--
-- Alter field scopes on apitoken
--
-- (no-op)
--
-- Alter field scopes on sentryapp
--
-- (no-op)

[markstory]

Scope names look good to me. I think you can skip the migrations as the scopes fields were removed earlier this week.