gusto: confirm OAuth scopes before building actions

Gusto doesn't let you just turn on API access — you have to apply and go through their review process first, and they decide which permissions ("scopes") your integration gets based on what you say you'll use it for. That review takes about 1-2 months.

Right now, the only scopes on record are: `public`, `webhook_subscriptions:read`, and `webhook_subscriptions:write`. Those won't cover the actions in the main issue (payroll, employee records, time off) — those need read/write access to payroll and employee data specifically.

This needs to be resolved before the actions are built, or they won't have the access they need to work.

No repository file or test is named. Start by reviewing the Gusto integration requirements and the scopes currently recorded in this issue, then confirm with Gusto which payroll, employee-record, and time-off read/write scopes can be approved; done means the required scopes are confirmed before action development begins.

Written by the indexing model from the issue text.