fix: only add IAM scope to credentials that can change scopes (#451)

7 files changed