Create a oauth.approvals scope for managing approvals

Based on the issue
https://github.com/cloudfoundry/uaa/issues/66

The following fixes have been implemented in UAA and login server
https://github.com/cloudfoundry/uaa/pull/67
https://github.com/cloudfoundry/login-server/pull/41

Accessing the /approvals URL requires a specific scope, oauth.approvals. By default the login client should have this scope preconfigured. This change may affect existing installations that wish to allow the login client to manage approvals.

Existing login clients can be amended with
uaac client update login --scope "openid, uaa.user, oauth.approvals"

@rmorgan should approve