User-account OAuth refresh request serializes scope field as scopes

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In `src/auth/src/credentials/user_account.rs`, `Oauth2RefreshRequest` defines the parameters sent to the OAuth token refresh endpoint:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/user_account.rs#L564-L570

Under RFC 6749 §6, the optional scope parameter is named `scope`. In `Oauth2RefreshRequest`, the field is named `scopes` without `#[serde(rename = "scope")]`.

Consequently, the payload serializes as `"scopes": "..."`. Google's OAuth endpoint ignores unknown parameters, so custom requested scopes configured via `with_scopes` are ignored during token refresh.

Start in src/auth/src/credentials/user_account.rs at Oauth2RefreshRequest and inspect how its fields are serialized for the OAuth token refresh endpoint. Verify the serialized parameter name for custom scopes configured through with_scopes, then add or run a focused serialization test if the surrounding auth tests provide one. Done means the refresh request uses the RFC 6749 scope parameter and custom scopes are preserved.

Written by the indexing model from the issue text.