fix(oauth): make scopes work with auth code flow

Matt Glamanrequested to merge
issue/canvas-3566458:3566458-oauth-scopes-only into 1.x

Closes #3566458

Merge request reports