Reject unknown Okta management tokens in strict mode

• Add okta.strict_scopes: on /api/v1 routes, an SSWS API token or bearer access token that does not come from seed config, server options, or an OAuth exchange returns 401 with E0000011 instead of acting as the default user.
• Keep the existing E0000004 response for requests without credentials and the fallback in the default mode, with regression coverage and docs.

References:

• E0000011 "Invalid token provided" with HTTP 401 for an API token Okta does not accept: https://support.okta.com/help/s/article/HTTP-401-Okta-E0000011-Invalid-Token-provided-error

Fixes #361