Combine a live grant's scopes with a new request's scopes.
The live grant's scope entries (empty when none).
The scope entries the new request asks for.
Live entries the app gives up.
The merged scopes plus the kept/added/removed breakdown.
Pure: no network. Order is live entries first (in grant order), then the newly requested ones, so a diff against the previous grant reads naturally.
When an entry is both requested and removed.
Combine a live grant's scopes with a new request's scopes.