v2: send proper scopes for authorization failures

Fixes #1278.

endpoints/v2/tag.py

@@ -9,8 +9,8 @@ from endpoints.decorators import anon_protect
 from data import model
 
 @v2_bp.route('/<repopath:repository>/tags/list', methods=['GET'])
-@process_registry_jwt_auth
 @parse_repository_name()
+@process_registry_jwt_auth(scopes=['pull'])
 @require_repo_read
 @anon_protect
 def list_all_tags(namespace_name, repo_name):