Expose required OAuth2 scopes via new endpoint:
GET /oauth2-scopes