Refactor grant types

See #88 for background.
Contains cherry-picked #109 (because of the scopeExists() method). Will be rebased once #109 is merged.

Aside from big code cleanups, this fixes a wide range of problems around scope handling in token requests:
- For "authorization_code" a scope parameter was accepted and validated despite not being in   the spec. Now removed (the authorization code scope is used unchanged).
- For "client_credentials" and JWT no validation was done, allowing invalid scopes to be set.
- For "password" the requested scope was never set or validated, the default scope was always set instead.

The test coverage is also obviously incomplete since it didn't catch the mentioned problems.

General approach:
- Removed getTokenDataFromRequest from the interface and from the grant types (except in JWT where it is used as a helper function). 
- Removed validateTokenData() from the intreface and from all grant types.
- Renamed createAccessToken() to grantAccessToken() and extended it to perform validation (matching the pattern found elsewhere in the library: if the function returned NULL, there was obviously a validation error)
- Default scopes are no longer validated (the DB hit is pointless since the default scope came from there in the first place)
- We explicitly fail if both scope and default scope are empty (the logic before was so tricky to follow that even I couldn't do it)

Notes:
- I'm not really happy about having to inject $scopeUtil in grantAccessToken(), but the alternative is passing it in the constructor, which is a can of worms.
(I would prefer doing it through the constructor, but then we need to fix the mess in the Server class around instantiating default grant types, constructor values VS setters, etc).
- Tests will surely need some work. Some will no longer pass, some need to be extended to catch the problems above.
- This is largely untested, intended to solicit basic comments first.