fix(auth): confine OCM access token to the masked share endpoint

fix(auth): confine OCM access token to the masked share endpoint #91397