Invalid validation of scopes when using PAT (with ZSS)

Describe the bug
This issue is not strictly related to ZSS, but it is possible to simulate it there because ZSS is not using ZaasClient or a similar approach as other services. The ZSS downloads the JWK from Gateway and then the validation is without any call locally. But fixing just ZSS is probably not the solution.

When the user sends the request with PAT (with invalid scopes - the service is missing from the list) the Gateway asks ZAAS to apply the authentication scheme it returns 401. The ZAAS rejects the token because of scopes. The gateway then leaves the token in the request and continues treatment. A service such as ZSS validates the token with JWK and decides it is valid because the signature and expiration time are valid.

This concrete use case contains a couple of issues:

1. there is no reason to propagate PAT with invalid scopes

• ZAAS should rather return 403 in case of invalid scopes and Gateway then remove all attributes about credentials (as Gateway does in case of successful credential transformation)

2. ZSS doesn't support PAT

• it should recognize PAT and solve in a different way (check the scope)
• the easy implementation should be to verify scopes in all cases and skip if they are missing (the regular JWT)

3. ZSS accepts a revoked token

• it should call GW via ZaasClietn

4. Zaas Client does not support PAT

• to verify PAT through the Zaas Client is necessary to provide serviceId

Steps to Reproduce

1. deploy Zowe with ZSS
2. generate PAT without scope zss
3. access an endpoint on ZSS
4. endpoint is accessible

Expected behavior
The response code should be 401