FEATURE: Add read-only scope to API keys (PR #14856)

This commit adds a global read-only scope that can be used to create new API keys.


Maybe we leave the default scopeMode empty? It would mean that the long list of scopes won’t be shown, and the Scope dropdown will match User Level, i.e. be empty.


One nice addition in the UI would be to add a description for the Global and Read-only scopes. We have a lot of text (and UI elements) for the Granular scope, but nothing for the other two types.

I implemented these suggestions, thanks for the feedback!