Ensure that clients can only be granted pre-approved scopes.
[PF-487] Internal server errors when scopes are involved

This commit ensures that the scope field isn't queried when finding
access tokens using a DM query. The scope is instead filtered using
a select on the result.
[PF-486] Detect invalid scope in client_credentials request

Only the 'password' grant_type checked that the requested scopes
where present in the client. This commit ensures that the same
check is made for the 'client_credentials' grant type.
Merge branch 'PF-487' into functional