Use read_api scope for GitLab OAuth app

read_api scope is now available for for GitLab OAuth apps which is perfect for our use case.

We should use the most minimal scope and switch from api to read_api.

• gitlab-org/gitlab!28944 (comment 322904691)
• gitlab-org/gitlab#21909 (closed)