Clean up/consolidate API scopes

It looks like some scopes are unused, like `profile:read_private`. Also, some scopes like `openid` and `sub` don't need to be exposed to the user, as they always have to be requested. We can probably find some nicer UX here to make the list of requested scopes more useful.