Loosen up the Scope Regex to be a little more compliant with rfc6749#3.3

e.g.
https://datatracker.ietf.org/doc/html/rfc6749#section-3.3

Author: pgermishuys

access-token-management/src/AccessTokenManagement/Scope.cs

@@ -23,9 +23,11 @@ namespace Duende.AccessTokenManagement;
 
     public override string ToString() => Value;
 
-    // According to RFC 6749, the scope is a space-separated list of strings.
-    // it can only contain characters in the set [A-Za-z0-9\-._~+/:\^|`!#$%&'*]
-    [GeneratedRegex(@"^([A-Za-z0-9\-._~+/:\^|`!#$%&'*]+ ?)+$")]
+    // According to RFC 6749, the scope is a space-separated list of scope-token(s).
+    // Reference: https://datatracker.ietf.org/doc/html/rfc6749#section-3.3
+    // scope       = scope-token *( SP scope-token )
+    // scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
+    [GeneratedRegex(@"^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$")]
     private static partial Regex _validScope();
 
     private static readonly ValidationRule<string>[] Validators = [
@@ -34,7 +36,7 @@ namespace Duende.AccessTokenManagement;
     ];
 
     /// <summary>
-    /// You can't directly create this type. 
+    /// You can't directly create this type.
     /// </summary>
     /// <exception cref="InvalidOperationException"></exception>
     public Scope() => throw new InvalidOperationException("Can't create null value");
@@ -60,7 +62,7 @@ public static bool TryParse(string value, [NotNullWhen(true)] out Scope? parsed,
     /// <summary>
     /// Parses a value to a <see cref="Scope"/>. This will return null if the provided string
     /// is null or whitespace. This is a convenience method for when you want to parse a value that may
-    /// contain null or whitespace strings. 
+    /// contain null or whitespace strings.
     /// </summary>
     public static Scope? ParseOrDefault(string? value) => StringParsers<Scope>.ParseOrDefault(value);
 }

access-token-management/test/AccessTokenManagement.Tests/Types/ScopeTests.cs

@@ -0,0 +1,35 @@
+// Copyright (c) Duende Software. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+namespace Duende.AccessTokenManagement.Types;
+
+public class ScopeTests
+{
+    [Theory]
+    [InlineData("!")]
+    [InlineData("#")]
+    [InlineData("$")]
+    [InlineData("[")]
+    [InlineData("]")]
+    [InlineData("^")]
+    [InlineData("~")]
+    [InlineData("[word]")]
+    [InlineData("path/to/resource")]
+    [InlineData("<tag>")]
+    [InlineData("{foo:bar}")]
+    [InlineData(":foo.v1.baz.{{bar}}.*")]
+    public void Scope_with_valid_value_should_not_throw(string scopeValue) => Should.NotThrow(() => Scope.Parse(scopeValue));
+
+    [Theory]
+    [InlineData("")]
+    [InlineData(" ")]
+    //Control Characters
+    [InlineData("\t")]
+    [InlineData("\n")]
+    //Backslash and double quote
+    [InlineData("\"")]
+    [InlineData("\\")]
+    [InlineData(" leadingspace")]
+    [InlineData("trailingspace ")]
+    public void Scope_with_invalid_value_should_throw(string scopeValue) => Should.Throw<InvalidOperationException>(() => Scope.Parse(scopeValue));
+}