Allow adding extra scopes to gitlab oauth tokens?

[maxhaton]

Feature description

Currently the authentication with gitlab is done such that the final token only has scopes that let it read and write repositories, it would be useful if one could optionally add to this e.g. read_api and so on, e.g. so other tools authenticating with the same gitlab instance can avoid implementing their own oauth flow.

The change to do so would presumably be trivial, is there a security reason not to?