fix(docs): make the generation guard actually fail, and tighten three labels

`generateBlockDoc` catches its own errors so one unreadable block does not
abandon the other 300, which meant the unknown-OAuth-service guard added
here logged and let the run exit 0. A missing page and a successful build
is the worst pairing of the two, and CI reads the exit code. Per-block
failures are now collected and reported at the end, so the run exits 1 and
names the block. Verified by pointing a block at a nonexistent service:
exit 1, block named. Individual blocks still do not abort the whole pass.

`Connecting X requests these scopes` overstated its own table: a service
account or a pasted API token connects the same integration without that
flow and is not governed by it. Now `Connecting X through OAuth`.

`ChannelMessage.Send` said "Write to Microsoft channels", which reads as
general channel write rather than sending a message.
`AppRoleAssignment.ReadWrite.All` omitted the read half of the grant. Both
show on the consent screen as well as in the docs.

Author: mzxchandra