Remove cycles from scim, approvals and oauth

I think it's time to extract the scim implementation into a separate jar,
which might avoid some of these problems by imposing the discipline
explicitly.  In the meantime, here is a proposal for how to lay out the 
new cleaner packages.  Main observations:

* The interfaces and utilities shared between approvals and user data
(Queryable etc.) are in a new top-level package called "rest"
* It feels like we are re-inventing a wheel there.  Someone should look at
Spring Data and Spring HATEOAS.
* I find it awkward that the JSON deserializers for Scim* have to be
implemented by hand.  It used to work with the defaults from Jackson,
so what changed?