tokenserver: Allow customizing list of OAuth scopes to use for CRL fetch.

tokenserver/api/admin/v1/config.proto

Index: tokenserver/api/admin/v1/config.proto
diff --git a/tokenserver/api/admin/v1/config.proto b/tokenserver/api/admin/v1/config.proto
index db59203bdebcdc580104deb2c9b7082d3e565f78..d09c9f8638bc83318d950a6fcf26311a7682210e 100644
--- a/tokenserver/api/admin/v1/config.proto
+++ b/tokenserver/api/admin/v1/config.proto
@@ -32,6 +32,7 @@ message CertificateAuthorityConfig {
   string cert_path = 2; // path to the root certificate file in luci-config
   string crl_url = 3;   // where to fetch CRL from
   bool   use_oauth = 4; // true to send Authorization header when fetching CRL
+  repeated string oauth_scopes = 7; // OAuth scopes to use when fetching CRL
 
   // KnownDomains describes parameters to use for each particular domain.
   repeated DomainConfig known_domains = 5;