[cfid-608] Password grants do not filter scope for user groups

This problem goes pretty deep into the authentication model
for the TokenEndpoint, so I think the fix should come from
Spring OAuth.

When an authorization request is being generated, it could
be a plain old UsernamePasswordAuthenticationToken
in the case of a password grant.  The old code worked but only for
an implicit grant.  The new version actually makes sure it
is an OAuth2AuthenticationToken

[Fixes #44363579] [cfid-608] Password grants do not filter scope for user's groups

Change-Id: Ic194cc38bdbf2f90b4a90c32effdb348a0c4e4a0