Fix gh-18565: Support consent for clients with no registered scopes

[ryujungkyun]

Description

This PR addresses gh-18565, where the OAuth2AuthorizationConsentAuthenticationProvider incorrectly handles authorization consent for a RegisteredClient with no registered scopes.

When requireAuthorizationConsent(true) is set for a client with no scopes, the provider currently:

1. Throws an ACCESS_DENIED error because it assumes an empty authority set implies user denial.
2. Throws an IllegalArgumentException from OAuth2AuthorizationConsent.Builder because building with an empty authority set is not permitted.

Changes

• Updated the logic to only throw ACCESS_DENIED if requestedScopes is not empty.
• Conditionally call OAuth2AuthorizationConsent.Builder.build() only when authorities are present.
• Added a cleanup step to remove stale consent records when the resulting authority set is empty.

Related Issue

Ref: gh-18565

How to Test

I have added a reproduction test case: authenticateWhenNoScopesAndConsentRequiredThenReturnAuthorizationCode() in OAuth2AuthorizationConsentAuthenticationProviderTests.