KEYCLOAK-569 Check application roles for scope

This is required as application roles may be composite roles that grant access to realm or other application roles