Java Mail Oauth for gmail: require full mail scope for sending emails only

JavaMail oauth requires full mail scope for sending email via gmail.

Used scope "`https://www.googleapis.com/auth/gmail.send`" for authorization.
and then got refresh and access token.

Java mail:

transport.connect(host, port, username, access_token);

Got error:

Caused by: jakarta.mail.AuthenticationFailedException: OAUTH2 asked for more
at com.sun.mail.smtp.SMTPTransport$OAuth2Authenticator.doAuth(SMTPTransport.java:1121)
at com.sun.mail.smtp.SMTPTransport$Authenticator.authenticate(SMTPTransport.java:924)

After changing scope to "`https://mail.google.com/`" for authorization, it works. But this scope will authorize

send, read, delete all emails.

This scope is too much, no difference from password authentication.

Start by reading the OAuth2Authenticator.doAuth and SMTPTransport.java locations named in the stack trace, then reproduce SMTP authentication with the gmail.send scope and the shown transport.connect call. Done means sending mail works with the narrower scope instead of requiring https://mail.google.com/.

Written by the indexing model from the issue text.