[Uno-d] Restrict access to OAuth2 scopes if signed out

With explicit browser sign in, the user might be signed in on the web
and have valid refresh tokens but is not signed in to the browser.

If the browser is not signed in, access to access tokens is restricted
to certain scopes. This CL ensures that OAuth2 access scopes that
requires the user to be signed in to the browser can't be requested if
not allowed.

Note: Some scopes aren't yet restricted and will be handled on follow-up
CLs.

Bug: b/321900823
Change-Id: If203ca9670ba24d631ade414beb3db123c690cfc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5537894
Reviewed-by: David Roger <droger@chromium.org>
Commit-Queue: Monica Basta <msalama@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1301881}