Resolves a refresh grant’s requested scope against the token’s original scope,
per RFC 6749 §6: absent scope, the original set carries over unchanged; a
space-delimited subset narrows it; anything outside the original set is rejected.
RFC 9700 §4.14.2: presenting a refresh token that has already been revoked — by a rotation
that superseded it, or by /revoke — is evidence the token leaked, so the whole (user, client)
family is taken down instead of only this request failing. Without that, an attacker who
redeems a stolen token first keeps a self-renewing family alive while the victim silently
re-logs-in into a new one.