Don't redirect on mismatching scopes if configuration is disabled

[minichate]

What this PR does

This skips the redirect-to-reauthenticate block in LoginProtection

We had an incident earlier this week where we were doing a scope upgrade and despite us disabling reauth_on_access_scope_changes ahead of time.

The scopes were updated/backfilled on the Shopify Core side, but since the cached scopes in user and shop models were a subset of the actually-approved scopes in Core requests were rejected with a 401 response without even sending them to Core.

This was surprising behaviour to us since we'd disabled the feature intentionally ahead of time.

Reviewer's guide to testing

1. Have an existing set of scopes cached on the user and shop models
2. Add a new scope c (ie: in config.scope)
3. Set reauth_on_access_scope_changes = false in your app's shopify_app initializer
4. Try and use the app; you'll get a 401 response from XHR requests, and a redirect for regular document requests.

Checklist

Before submitting the PR, please consider if any of the following are needed:

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed.

[jeremywrowe]

I approved, the code looks good. In addition to the change there needs to be updates to documentation and the changelog.