Reworked the use of scopes.

Instead of requesting all scopes up front, each sub-section of the backup/restore will request the permissions that are relevant for the operation.

The effect is that it is not required to grant all permissions to get a backup running. If permissions are failing, that part of the backup will generate warnings for items that are excluded.

proprietary/GoogleWorkspace/SourceItems/GmailSettingFileSourceEntry.cs

@@ -2,6 +2,7 @@
 
 using System.Text.Json;
 using Duplicati.Library.Common.IO;
+using Google.Apis.Gmail.v1;
 
 namespace Duplicati.Proprietary.GoogleWorkspace.SourceItems;
 
@@ -13,14 +14,13 @@ internal enum GmailSettingType
     Signatures
 }
 
-internal class GmailSettingFileSourceEntry(SourceProvider provider, string userId, string parentPath, string filename, GmailSettingType type)
+internal class GmailSettingFileSourceEntry(string userId, string parentPath, string filename, GmailSettingType type, GmailService service)
     : StreamResourceEntryBase(SystemIO.IO_OS.PathCombine(parentPath, filename), DateTime.UnixEpoch, DateTime.UnixEpoch)
 {
     public override long Size => -1;
 
     public override async Task<Stream> OpenRead(CancellationToken cancellationToken)
     {
-        var service = provider.ApiHelper.GetGmailService(userId);
         object? data = null;
 
         switch (type)