"https://www.googleapis.com/auth/cloud-platform" is a superset of "https://www.googleapis.com/auth/bigquery". We should only need 1, and per the rest of cloud we should use "https://www.googleapis.com/auth/cloud-platform"

Note: I'm filing this issue due to googleapis/google-auth-library-python#1204. I believe that even after the issue identified there is addressed (default scopes shouldn't cause user/impersonated credentials to downscope), google-auth might be downscoping credentials unnecessarily because it sees the "bigquery" scope and it's not present by default.