Allow sub-selecting role scopes when generating API tokens

[jc-harrison]

In the new permissions system (#5163), permission scopes are granted to roles, and roles are assigned to users, and a user can select which roles to include scopes from when generating an API token.

There are times when it may be useful to sub-select a role's scopes, e.g. when generating a token to be used for running one specific query. This is not currently possible via the FlowAuth frontend/API - it would be useful (although not essential) to enable this.

By the same reasoning, it would also be useful to be able to explicitly set a token's expiry to be earlier than the latest expiry allowed by the selected roles. This is slightly tricky to handle in the UI, because the default (i.e. latest permitted) expiry depends on the selected roles.