It is possible to define alternative required scopes for an operation
and in the security header of the operation it is rendered correctly.
However, in the "Required scopes" part it looks like that all these scopes are required.
With these changes, the "Required scopes" part shows the required scopes per set.
See: https://github.com/OAI/OpenAPI-Specification/discussions/3001#discussioncomment-3456275