tokenserver: Allow customizing list of OAuth scopes to use for CRL fetch.

tokenserver/api/admin/v1/config.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.admin;
 
 
 // TokenServerConfig is read from tokenserver.cfg in luci-config.
@@ skipping 14 matching lines @@
 // ("c.chromecompute.google.com.internal"), searches for a domain name in
 // "known_domains" set, and, if it is present, uses parameters described there
 // for generating a token that contains machine's FQDN and certificate serial
 // number (among other things, see MachineTokenBody in machine_token.proto).
 message CertificateAuthorityConfig {
   int64  unique_id = 6; // ID of this CA, will be embedded into tokens.
   string cn = 1;        // CA Common Name, must match Subject CN in the cert
   string cert_path = 2; // path to the root certificate file in luci-config
   string crl_url = 3;   // where to fetch CRL from
   bool   use_oauth = 4; // true to send Authorization header when fetching CRL
+  repeated string oauth_scopes = 7; // OAuth scopes to use when fetching CRL
 
   // KnownDomains describes parameters to use for each particular domain.
   repeated DomainConfig known_domains = 5;
 }
 
 
 // DomainConfig is used inside CertificateAuthorityConfig.
 message DomainConfig {
   reserved 2, 3, 4, 6; // deleted fields, do not reuse.
 
@@ skipping 131 matching lines @@
 // ServiceAccountRule describes a single allowed case of using service accounts.
 //
 // TODO(vadimsh): Implement.
 message ServiceAccountRule {
   // A descriptive name of this rule, for the audit log.
   string name = 1;
 
   // Email of developers that owns this rule, to know who to contact.
   repeated string owner = 2;
 }