OAuth security scheme: empty scopes element is still rendered

[meden]

Describe the bug
When defining an oauth2 security scheme, if no scopes are used the scopes element still gets rendered (as empty) in the resulting page.

Expected behavior
scopes information should be hidden (just like refreshUrl).

Minimal reproducible OpenAPI snippet(if possible)

openapi: 3.0.3
info:
  title: OAuth2 API
  version: '1.0'
  description: This is an API.

paths:
  '/res':
    get:
      operationId: get
      description: Returns something.
      responses:
        '200':
          description: Some resource.
          content:
            application/json: { }

components:
  securitySchemes:
    OAuth2:
      type: oauth2
      description: You know it.
      flows:
        clientCredentials:
          tokenUrl: /auth
          scopes: { }

security:
  - OAuth2: [ ]

Screenshots

Additional context
A similar issue (#1044) was already solved, but allowing a definition against OpenAPI specifications.