A checkable OAuth-style permission picker for granting API access scopes, with the basic read scopes prechecked and the org-owner-only admin scope shown as locked (disabled). Uses SHOW_ALL so every checked scope, parent and child, is reflected.