Keep extra non-required OAuth scopes for additional limited time

## Feature Description

Site Kit has always adhered to best practices for OAuth by only requesting the scopes that are needed when we need them. This is referred to as _[Incremental authorization](https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth)_. In practice, this means that we always request the minimal scope necessary (usually `readonly`) for a given service, and only requesting additional/write scopes on-demand. Site Kit is additionally conservative in the handling of these extra non-required scopes in that it will not continue to request them in future consent flows if not explicitly requested. This means that a user could grant an additional scope in one flow and that it may not be included in a subsequent flow that could happen shortly after which would be a poor experience.

Example:

- User connects Analytics, grants `analytics.readonly` scope
- User creates new Analytics property, grants `analytics.edit` scope as an extra/non-required
- User connects AdSense, grants `adsense.readonly`
- At this point, the `analytics.edit` scope is no longer included in the access token because it is not required, thus not included in the request
- User prompted to enable Enhanced Measurement, now needs to grant `analytics.edit` scope again and another consent flow

This is the scenario we are looking to improve by "remembering" a user's extra granted scopes for a limited time, so that we don't ask users for the same thing multiple times in a short period of time. The OAuth guidelines and best practices don't detail when a granted scope should be "released" (if ever), so this is still well within the guidelines.

---------------

_Do not alter or remove anything below. The following sections will be managed by moderators only._

## Acceptance criteria

*

## Implementation Brief

*

### Test Coverage

*

## QA Brief

*

## Changelog entry

*

The issue names no files, tests, or entry points, and its acceptance criteria and test coverage sections are empty. First identify the OAuth scope-handling entry points and relevant tests; done means extra granted scopes are retained for a limited time so users are not repeatedly prompted for the same scopes.

Written by the indexing model from the issue text.