CFID-307: use uaa/user and uaa/admin for existing authorities

- The database now has a String column for authorities
- The default value is 'uaa/user'
- An admin user has 'uaa/admin,uaa/user' (CSV)
- The ScimUser still only has a userType (per the core schema)
- No support in ScimUser for additional groups, but
  UaaUser will carry over authorities that are not uaa/*
  to the tokens

Change-Id: I84355953df2ac0e46de281a176b8368e4c856eaa
CFID-307: add groups to ScimUser and map to authorities in JDBC

Change-Id: Ieb7f71c325214e51a87eacb1e5bc742ad98ea7b7
CFID-308: all scopes converted to period separators

- No migrations provided for client registrations
- All tests passing on an empty system

Change-Id: I6fbc3fe7652f4c919db1537237816f0ca17739b6
CFID-309: switch to period-separator for role names

Change-Id: Ibbafb89f4265b2e63e9f8e3180708555d73ff8a3
CFID-309: remove resource ids from client registration in default config

Several new rules implemented as UaaAUthorizationRequestFactory:
* For client_credentials grants, the default scopes are the client's granted authorities
* For other grant types the default scopes are the registered scopes in the client details
* Only scopes in those lists are valid, otherwise there is an exception
* If the scopes contain separators then resource ids are extracted as the scope value up
to the last index of the separator
* Some scopes can be hard-wired to resource ids (like the open id connect values), in
which case the separator is ignored

Change-Id: Ifac8b57435ac9199af4b20a1dd2d90a91674698c
CFID-309: add basic legacy client migration to ClientAdminBootstrap

Change-Id: Iad1c36506cfb2203370b674d5aff0ccf5f542feb
CFID-320: Add additional information to oauth client schema

Change-Id: If37b239f0c2fd39fa89fed801d704ef6d1011f0d
CFID-320: allow additional approval parameters

(Requires update in Spring Security OAuth)

Change-Id: I2373fd9e51e81ea5219147c6b50fab7183414b9a
CFID-320: use externalId for scope names in group representation

(Reserving the display name for a user-friendly default description.)

Change-Id: I731309d28eeb945e2d252aa694256e9b484cd8f3
SECOAUTH-309: Enhance token scopes with user authorities

- The UaaAuthorizationRequestFactory has a configurable map of
includes and excludes (authority name to collection of scopes)
- The authority name is added by default if no includes are
provided
- All OAuth2 resource endpoints are now secured by scope
- Tokens only contain scope (not authorities) - should be
less confusing for resource servers and developers

Change-Id: I783b36d181ccd273a6ab20f18b6b72f1a71422ff
SECOAUTH-309: merge changes from master

Change-Id: I78d2c7626738257ab4a355f81fd2347d1c954032
CFID-307: tweak scopes changes for live postgres

- fix DDL script to be more lenient about existing records
- verify integration tests (once app client has correct
registered scopes)

Change-Id: Ied925526df99d7648d51758d18ae88d49cdf3389
Updates from Spring Security

Change-Id: I83b914796c90a40062994ba38a01387c4070e9c4
More updates from Spring Security

Change-Id: I6527d467fcb46638f008db0b4826a51d7f4fa1c0
new test stub server and focus on uaac

Change-Id: Ie0490515432130058c9b4a088e59b5dac09940c1
CFID-309: Merge from master to scopes

Change-Id: Ib6cd772f2f8e2bd58e4ae65fd2de6561c0fd5c67
CFID-332: Token validity seconds can now be null by default

Change-Id: Ic28311304dd2cf67e74168897089bc7160f12a7f
CFID-327: add /Users to SCIM endpoints for singular resources

Change-Id: Idbcd3013763902383391a0a9b4d570a8b48bf414
Merge from master to scopes

Change-Id: I2e634fb7176e31e2469231f1c163cc3f93cee1b5
CFID-321: added extra /varz for client and user account operations

Change-Id: Ifb634e27f8d4fe3afb92044e0b572c2fc3633c0e