Set better default scope for keycloak

Unfortunately this config can't be set at runtime (eg in a Docker container), so at least use a default that more likely reflects the reality.