oauth2 webhook: `granted_scopes` always empty for `authorization_code`

[sousandrei]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• [] I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• [] I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Related to #3620
But when running OIDC flows with a token hook, the call does not include granted_scopes

Reproducing the bug

Same steps as #3620

Relevant log output

Relevant configuration

Version

2.3.0

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

Working on a PR to address this #3970