[cfid-608] Password grants do not filter scope for user groups

This problem goes pretty deep into the authentication model
for the TokenEndpoint, so I think the fix should come from
Spring OAuth.

When an authorization request is being generated, it could
be a plain old UsernamePasswordAuthenticationToken
in the case of a password grant.  The old code worked but only for
an implicit grant.  The new version actually makes sure it
is an OAuth2AuthenticationToken

[Fixes #44363579] [cfid-608] Password grants do not filter scope for user's groups

Change-Id: Ic194cc38bdbf2f90b4a90c32effdb348a0c4e4a0
Remove the token store. Change refresh tokens to jwt.

Also includes:
- Removal of the token admin endpoints
- Expire refresh tokens when the user changes their password
- Remove the token lookup from the app sample
- Remove the need for a separate refresh grant. Authcode and password grants will
  automatically get a refresh token.
- Updated app sample with a link to revoke approvals
- Remove the tokens.* scopes

[#44041363]
[#43589475]
[#38710223]

Change-Id: I96737fece7356e9ae00c7daa2edfd102e2c445e7