No way to purge without the purge_all scope

Problem/Motivation

TL;DR version: When a Fastly token lacks the purge_all scope, there's no way to purge.

Full version: Multiple sites are using the same Fastly api_key, with their site_id being different. As the sites should NOT be able to purge objects belonging to other sites, the purge_all and global scopes are NOT present; only purge_select and global:read are present. Because of the code in \Drupal\fastly\Api::validatePurgeToken(), the token is NEVER considered valid, therefore no purging is possible at all.

Steps to reproduce

• Get an api_key/token with only purge_select and global:read scopes.
• Configure the site to use this api_key.
• Visit /admin/config/services/fastly.
• Set a unique "Site ID".
• Click "Purge / invalidate all site content".

Actual behavior:

• Next to the button, this message appears: "Something went wrong while purging / invalidating content. Please, check logs for more info."
• Upon the next full page load, this error message appears: "Invalid API token. Make sure the token you are trying has at least global:read, purge_all, and purge_all scopes."
• No purging occurs.

Expected behavior:

• Next to the button, this message appears: "All site content is purged / invalidated successfully."
• No error message upon the next full page load.
• Objects belonging to the current Site ID are purged.

Proposed resolution

• Fix the logic in \Drupal\fastly\Api::validatePurgeToken().
• Fix the message in \Drupal\fastly\Form\FastlySettingsForm::validateForm() (eg. so purge_all is not repeated twice), with regards to the above fix.

Remaining tasks

Discuss, fix, commit, release.

User interface changes

Preferably none, but some changes might be needed to make it clearer what is needed for what.

API changes

None.

Data model changes

None.