Support permissions from Signon as Array or Hash

This enables us to gradually upgrade each app to support new and old
formats, then when we're ready, we can change Signon to emit Arrays.

The reason for the format change is because it's unneeded complexity
that existed when we provided the permissions for a user for every app
to every app. That is bad for security in terms of info sharing: it
tells you the valuable user accounts.
Generate warning when Config.default_scope is used

We don't need this config item any more, but removing it will mean that
any references to it generate an error. Because there are references to
it in files copied in from alphagov-deployment at deploy time, we can't
control the references easily.
Remove line that was only present for testing
Merge pull request #11 from alphagov/migrate_from_app_name_in_permissions

Migrate from app name being present in permissions