Merge ['zf-oauth']['options'] the correct way around

If I define 'enforce_state', 'allow_implicit' or 'access_lifetime' in
the 'options' sub-array, they should work. i.e. setting these three
settings in the top level 'zf-oauth2' setting is a shortcut.