chore(galaxy): API key vs access token permissions after scope implementation

[betimshahini]

1. Revisit what data resolvers return for requests with the following values:

• [ ] openid
• [ ] profile
• [ ] email
• [ ] connected_accounts To think about: if check is done in Galaxy or downstream in the workers. Assumes no data is public and all data is permissioned through what the authorized scope values provide access to, including persona data.

Dependent on #2024

2. Determine if there are any other galaxy ops that don't perform user-targeted work