Score AI agent OAuth scope risk from granted scopes, app owner, token age, data class, and action capability