fix: use def. scopes if no scope param is present in tok exch

Use default scopes - intersection of subject token scopes and allowed
client scopes for token exchange