OAuth scope hierarchy matching

Check whether a granted OAuth scope set satisfies a required scope set with hierarchical wildcards. Scopes are colon-delimited (e.g. 'repo:read', 'admin:*'). A granted scope satisfies a required scope if they are equal, OR the granted scope ends in a '*' segment and its prefix segments are a prefix of the required scope's segments (e.g. 'admin:*' satisfies 'admin:read' and 'admin:billing:write'; '*' satisfies everything). Return True only if every required scope is satisfied by at least one granted scope.