TLDR: The token Pokemon Go gets can't directly query your email, however the app still needs to be fixed.
- openid
- https://www.googleapis.com/auth/userinfo.email
- https://www.google.com/accounts/OAuthLogin (this scope does much more than it appears. see update on the bottom for more info)