I need this for:

• UI to create reduced scope tokens from the /-/create-token page #1947

And I can refactor this to use it too:

• datasette create-token ability to create tokens with a reduced set of permissions #1855

By making this a documented internal API it can be used by other plugins too. It's also going to be really useful for writing tests.