Granular Oauth Scopes

### Required Terms

- [X] I agree to follow this project's [Code of Conduct](https://github.com/heroku/roadmap/blob/main/CODE_OF_CONDUCT.md)
- [X] I have read and accept the [Salesforce Program Agreement](https://www.salesforce.com/company/program-agreement/)

Current Oath scopes for Heroku is quite Broad and customers need to provide custom scopes to limit the access to Heroku resources.

Eg:
Billing Alarm

As the name suggests, this add-on needs access to the [Invoice Info](https://devcenter.heroku.com/articles/platform-api-reference#invoice-info) and [Team Invoice Info](https://devcenter.heroku.com/articles/platform-api-reference#team-invoice) endpoints of the Heroku Platform API through an OAuth Authorization created by a Heroku user.

Currently this can only be achieved by creating an Authorization with the global scope. This is a big no-go for us.

We need the ability for a Heroku user to create an Authorization with a custom set of permissions / scope that allows us to do the above and nothing else.

In a world where cyber security is paramount, fine-grained access control is a relatively simple, but powerful feature.

This would also greatly lower the threshold for Heroku users to integrate with third party applications, because they trust the provided Authorization token can only be used within its limited scope.