Relax oauthlib scope check for Google group enrollment

[payamnj]

Summary

Fixes an OAuth redirect failure reported from production logs:

```
{"levelname": "ERROR", "name": "django_email_learning.oauth_integrations.views", "message": "Error processing OAuth redirect: Scope has changed from "https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.readonly\" to "https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/userinfo.email openid"."}
Bad Request: /email_learning/oauth/redirect/

**Root cause**: Google commonly grants additional scopes we didn't request (`openid`, `userinfo.email`, `userinfo.profile`) alongside the two we do request (`admin.directory.user.readonly`, `admin.directory.group.readonly`) in `GoogleGroupEnrollmentHandler._build_flow()`. `oauthlib` (used internally by `google-auth-oauthlib`/`requests-oauthlib`) treats *any* difference between requested and granted scopes as fatal by default — it literally does \`raise Warning(...)\` — unless \`OAUTHLIB_RELAX_TOKEN_SCOPE\` is set. That exception propagates out of \`flow.fetch_token()\` in \`handle_redirect()\`, gets caught by the generic \`except Exception\` in \`oauth_integrations/views.py\`, and turns an otherwise-successful authorization into a 400.

## Fix

Set \`OAUTHLIB_RELAX_TOKEN_SCOPE=1\` immediately before \`flow.fetch_token()\` in \`GoogleGroupEnrollmentHandler.handle_redirect()\` (\`django_email_learning/oauth_integrations/group_enrollment/google_group_enrollment_handler.py\`).

## Verification

Before writing the fix, I reproduced the exact bug locally by mocking the Google token endpoint response with the same superset-of-scopes payload from the log line above and confirming \`oauthlib\` raises the identical \`Warning: Scope has changed from ... to ...\` message. Then confirmed \`OAUTHLIB_RELAX_TOKEN_SCOPE=1\` resolves it. Both are captured as tests:

- \`test_handle_redirect_succeeds_when_google_grants_additional_scopes\` — reproduces the reported scenario (Google granting a superset of scopes); I verified this test actually fails without the fix (temporarily reverted it, confirmed the test catches the regression, restored it) before finalizing.
- \`test_handle_redirect_succeeds_with_exact_scope_match\` — confirms the normal/expected case still works.

## Test plan

- [x] \`pytest -q\` — 774 passed, 81.32% coverage
- [x] \`mypy\` — no issues across 163 source files
- [x] \`ruff check\` / \`ruff format\` — clean
- [x] Manually confirmed the new test fails without the fix and passes with it