Make it easier to choose minimal DwD scopes as well as subscopes

Today the command

```
gam user check serviceaccount
```

expects the admin user to grant GAM *ALL API scopes*. If a given scope is skipped or not given GAM calls that a *FAIL* and directs the admin to give it additional access. This is against the [principal of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege).

In an ideal world:
- GAM would prompt the admin during setup to choose which commands / APIs / scopes (which makes most sense from admin perspective here?) they wish to use.
- GAM would not request scopes or permissions it does not need to do what the admin wants to do.
- If the admin decides to run a command that needs permissions / scopes the admin did not grant GAM would handle that gracefully:
- BAD fail with ambiguous error message that leaves the admin wondering why GAM isn't working
- GOOD fail with an error message that directs admin to grant GAM the additional scopes / permissions it needs.
- BEST hold admin's hand and guide them through the permissions / scope upgrade (while making it clear to admin they are given GAM more powers and introducing new risk).