Add new audit log event when an OIDC IDP grants different scopes than requested

[joshuatcasey]

Is your feature request related to a problem? Please describe.

Pinniped admins would like to know when scopes requested by Pinniped are not being granted by the OIDC IDP.

Describe the solution you'd like

Add new audit log event when an OIDC IDP grants different scopes than requested, this should occur for both initial token exchanges and token refreshes.

Are you considering submitting a PR for this feature?

yes