OAuth2 scopes are removed when Authorizations are revoked

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.2.0 GA1
• Fix Version/s: 7.1.10 DXP FP25, 7.1.X, Master
• Component/s: Application Security > OAuth2
• Labels:
  • fc_19_10
  • liferay-fixpack-dxp-25-7110
• Branch Version/s:
  7.1.x
• Backported to Branch:
  Committed
• Sprint: AS - Iteration 23, AS - Iteration 24
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/79400

Steps to reproduce:

1. Go to OAuth 2 Administration and create an OAuth 2 application
2. Configure some scopes for the application and save it.
3. Use a client (command line, Postman, Insomia, ...) to access the OAuth application which will create an entry in `Authorizations`
4. Go to `Authorizations` tab and click on `Revoke` button (or select many and click "Revoke Authorizations")
5. Go back to "Scopes" tab

EXPECTED RESULT: The scopes are still properly configured

ACTUAL RESULT: All scopes are removed (unselected) from the application

As a result, revoking access for just one client blocks all clients from accessing the application until the scopes are reconfigured.