[App2App] Scopes should be validated according to client type

Assume AppA is authenticated, and AppB is not authenticated.

Currently, when appB tries to authenticated with app2app by AppA, the scopes of AppA's session will be inherited to appB's session. Therefore, say if AppA supports a scope that AppB doesn't support, that new AppB's session will get an incorrect scope.

The issue names no files or tests; start by tracing the App2App authentication flow and how session scopes are copied between client types. Done means AppB's session retains only scopes supported by AppB, rather than inheriting incompatible scopes from AppA.

Written by the indexing model from the issue text.