[IAM tokens] Allow for multiple clients to be used

[chaen]

Currently, it seems like a single IAM client is used whenever we interact with the IDP. This means that the client has to have the union of all the scopes we could possibly want. This could be risky especially when scopes are requested client side