Oauth trust levels

This creates three 'trust levels' for OAuth applications based #107. It also allows a `max_scope` to be set for each application, allowing the types of scopes requested by them to be restricted. 

When an application asks for a scope or uses a grant type it is not allowed to use a `400 Bad Request is returned`.

I'm working on adding an admin interface for applications. 
Pretty sure the param should be `response_type`, [spec_examples](https://github.com/doorkeeper-gem/doorkeeper/blob/0d0e29e384186d27ef7b1919e59f2114435c0e52/spec/controllers/authorizations_controller_spec.rb#L93) and the [validation_code](https://github.com/doorkeeper-gem/doorkeeper/blob/685a5f3ed52c87c8bc951297dbe2d664b3d63ec8/lib/doorkeeper/oauth/pre_authorization.rb#L42).

This will change the allowed_request_type before filter as well.