Whether the approval page keeps scope checked. These scopes shape the
flow rather than grant access to data: openid asks for the id_token, and
the launch scopes for the context the app runs in (launch carries an EHR
launch’s patient and encounter). Every other scope the user may deselect.
Every requested scope must be within what the client is configured to
request. The configured scopes are a ceiling, not a list of exact strings:
patient/*.rs lets a client request patient/Medication.rs, and
patient/Medication.rs lets it request patient/Medication.s (see
[Scopes::covers_scope]).