Scope checking should be sets, not lists

[Thingus]

From #6581 (comment)

It's compared to other lists when we check it against the requested scopes; now I say that, a set would be better there too, but that probably belongs in a different PR

Given that there's no reason we need duplicate scopes, it's probably sensible to be passing scopes/permissions around as sets instead of lists