Fix OAuth scope satisfaction to AND-of-ORs (required means required)

Fix OAuth scope satisfaction to AND-of-ORs (required means required) #4857