Configurable scope for Dashboard Clients

Unfortunately, we were 90% done with this before we knew Cloud Controller work should be limited / halted. This can be merged whenever we are ready to start adding features again.

* Dashboard clients are given scope of cc_service_broker_client but no
* more than openid, cloud_controller.read, cloud_controller.write, and
* cloud_controller_service_permissions.read.

[#71594888]