Resolves #42836
Resolves #42839

• OrganizationAuthenticator.java -> ANY scope organization selection will be transformed to SINGLE
• OrganizationMembershipMapper.java -> resolve organization from the scope instead of client session note
• OrganizationScopes.java -> update name resolves to account for all possible token refresh scenarios

SINGLE Scope Tests (Previous: organization:foo)

• SINGLE → ANY: organization:foo + request organization → Result: organization:foo
• SINGLE → ALL: organization:foo + request organization:* → Result: organization:foo
• SINGLE → Different SINGLE: organization:foo + request organization:bar → Result: null
• SINGLE → Same SINGLE: Not explicitly shown, but would work via equality check

ALL Scope Tests (Previous: organization:*)

• ALL → SINGLE: organization:* + request organization:foo → Result: organization:foo
• ALL → Different SINGLE: organization:* + request organization:bar → Result: organization:bar
• ALL → ANY: organization:* + request organization → Result: null

Additional SINGLE Tests (Previous: organization:bar)

• SINGLE → ANY: organization:bar + request organization → Result: organization:bar
• SINGLE → ALL: organization:bar + request organization:* → Result: organization:bar
• SINGLE → Different SINGLE: organization:bar + request organization:foo → Result: null

ANY Scope tests

• N/A - the browser flow transforms the scope to SINGLE (see single cases above)