Oauth trust levels

This creates three 'trust levels' for OAuth applications based #107. It also allows a `max_scope` to be set for each application, allowing the types of scopes requested by them to be restricted. 

When an application asks for a scope or uses a grant type it is not allowed to use a `400 Bad Request is returned`.

I'm working on adding an admin interface for applications. 
The current implementation doesn't actually render the new template as the `params[:response_type]` is currently setup as `params[:request_type]`, thus [this check fails](https://github.com/doorkeeper-gem/doorkeeper/blob/0d0e29e384186d27ef7b1919e59f2114435c0e52/app/controllers/doorkeeper/authorizations_controller.rb#L6). I'd modify the examples here to test the render actually worked. E.g 
``` ruby
it 'should an ok status' do
  req
  expect(response.status).to eq(200)
end

it 'should render the approval page' do
  expect(req).to render_template(:new)
end
```