fix(Token): take over scope in token refresh with login by cookie

[blizzz]

Summary

When logging via cookie, the token was refreshed, but while doing so, the scope was not kept. It was applied from the old token, but not saved in session. This could be typically reproduced per:

1. Having SAML configured
2. In any Google browser, log in via SAML
3. Close the browser
4. Open the browser again

When running this query SELECT id, scope from oc_authtoken where uid ='USERID' the scope would be empty instead of '{"password-unconfirmable":true,"filesystem":true}'. So, after a while a password confirmation dialogue would open at specific actions, where it is not possible to verify it.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[blizzz]

/backport to stable29

[blizzz]

/backport to stable28

[blizzz]

/backport to stable27

[blizzz]

/backport to stable26