Don't try to parse response as JSON if it is an error. (#37)

If we get an error, this will often be a plain text string, and gets
obfuscated by the attempted json parsing. Return it as-is so we can read
it in full.

add scopes parameter (#34)

related to octo-sts/app#1008

use await instead of then (#10)

Signed-off-by: Jason Hall <jason@chainguard.dev>