Feature user limitation [rebased]

hello,

This is still a work in process and I need a bit of guidance/advice where to place the code (so we dont drift away from the oauth spec).

The idea is to evaluate a block to see if the current_resource_owner is allowed to acquire access to the application. This can be handy for many reasons, like an admin app only accessible if the user is admin, creating users and then assign the applications they can access and so on.
```
  resource_owner_allowed_for do |app_id, current_resource_owner|
    false
  end
```
What I would like to add/change:

- Correct place to place the check if the current_resource_owner is allowed the requested application, this is now done in the `pre_authorization` as an extra validation
Unused block argument - `app_id`. If it's necessary, use `_` or `_app_id` as an argument name to indicate that it won't be used. Also consider using a proc without arguments instead of a lambda if you want it to accept any arguments but don't care about them.<br>Unused block argument - `resource_owner`. If it's necessary, use `_` or `_resource_owner` as an argument name to indicate that it won't be used. Also consider using a proc without arguments instead of a lambda if you want it to accept any arguments but don't care about them.