[OAuth] userinfo endpoint ignores scopes

The userinfo endpoint only ever replies with claims for the openid scope, independent of scopes configured with the token request or the application.