Analyze OAuth scope sets for least privilege violations — detect critical, high, and overly broad scopes.