ShopStrategy#update_access_scopes? should only be true when user needs to approve new scopes

Issue summary

Before opening this issue, I have:

• Upgraded to the latest version of the package
  • shopify_app version:
  • Ruby version: 3.2.0
  • Operating system: Ubuntu
• Set log_level: :debug in my configuration, if applicable
• Found a reliable way to reproduce the problem that indicates it's a problem with the package
• Looked for similar issues in this repository
• Checked that this isn't an issue with a Shopify API
  • If it is, please create a post in the Shopify community forums or report it to Shopify Partner Support

We are dynamically requesting access scopes based on what features our clients want. This means that config.scope = ''.

When a store requests a certain feature, we prompt him to go through the OAuth flow with the additional scopes. This works fine. However...

Expected behavior

When a user logs out & signs in again, the shop access scopes should not change.

Actual behavior

When a user logs out & signs in again, the shop access scopes are reset to config.scope. The reason for that is this method:

module ShopifyApp
  module AccessScopes
    class ShopStrategy
      class << self
        def update_access_scopes?(shop_domain)
          shop_access_scopes = shop_access_scopes(shop_domain)
          configuration_access_scopes != shop_access_scopes
        end

It should only return true if the shop is missing some scopes, not when it has more that are set in config.scope. I believe UserStrategy is already following this logic - it only asks a user to confirm the new scopes when it's a superset of the existing ones.

A potential fix

module ShopifyApp
  module AccessScopes
    class ShopStrategy
      class << self
        def update_access_scopes?(shop_domain)
          shop_access_scopes = shop_access_scopes(shop_domain)
          (configuration_access_scopes.to_a - shop_access_scopes.to_a).present?
        end
      end
    end
  end
end

Locate ShopifyApp::AccessScopes::ShopStrategy#update_access_scopes? and compare its behavior with UserStrategy. Verify the scope comparison preserves scopes already granted to a shop and only triggers OAuth when configuration_access_scopes contains missing scopes; the proposed reproduction is logging out and signing in again with dynamically requested scopes.