[CLC-1350] New google token permissions + migration script to stash away old google tokens

JIRA: https://jira.media.berkeley.edu/jira/browse/CLC-1350

As a follow up to CLC-1235, this will actually make it possible for there to be a live drive feed to be pulled down by enabling the google drive scope (which I left at read-only for now). 

The migration script will only move the tokens (and tag them with the migration timestamp file), not delete them completely, since the team had a discussion a while back to avoid getting ourselves into irreversible migration scenarios. A few more migrations down the line, we should be able to remove the old backed up tokens.