Add oauth2.client.scope (CSV or YAML array)

Fixes gh-9