Client application specific scopes

This PR attempts to address https://github.com/doorkeeper-gem/doorkeeper/issues/317. We saw @tute's comments, but could not find a great way to implement this without either putting all of the logic into the authoriizations controller (doing an end run around the work that the `OAuth::PreAuthorizations` class does, or monkeypatching Doorkeeper a bit. So I created this PR in an attempt to implement this functionality in a way that fits with the rest of the Doorkeeper API.

It works by adding a `scopes` field to the `Doorkeeper::Application` model and validating the requested scopes against it during pre-authorization. When `enable_application_scopes` is set, the `Doorkeeper::Models::Scopes` mixin is added to `Doorkeeper::Application` and `validate_scopes` will check both the server/config scopes as well as the client application's scopes.

Still TODO: adding support to the admin pages and testing with ORM's besides ActiveRecord

In the meantime, I would greatly appreciate some feedback.

thanks,
-chris

Looking into the tests, there are already tests for the various possible cases for scopes (valid scope, nonsense scope, and config/server scope not in applciation scopes). I grouped them (https://github.com/cpapazian/doorkeeper/blob/b6e02e659f15a29422a39d892af167609c020fc2/spec/lib/oauth/pre_authorization_spec.rb#L82-L95) in this latest commit to make it easier to see how they were related.

Also, want to confirm the desired logic before making the change to the actual validation logic.