**As** an administrator
**I want to** validate the scope of JWTs
**so that** they can only be used in the context that they were intended to be used for.

**Acceptance criteria**

* For incoming JWTs, we validate the scope similar to how we do it for access tokens issued by Doorkeeper

* This means incoming JWTs need to carry a scope to be able to access our APIs Begin of the insertion(e.g.End of the insertion Begin of the deletion

* TBD: Potentially make a temporary exception for when validatingEnd of the deletion `api_v3` Begin of the insertionforEnd of the insertion requests Begin of the insertionto APIv3)End of the insertion