Changes to scope handling 

** This Breaks BC. Please see [v1.2](https://github.com/bshaffer/oauth2-server-php/tree/v1.2) if this breaks your application**

1. Ensures client scopes are always validated 
2. ensures client grant types are always validated 
3. moves client scope storage to OAuth2\Storage\ClientInterface 
4. refactors storage classes for interface change 
5. TokenController now requires OAuth2\Storage\ClientInterface

This breaks backwards compatibility, but offers significant security fixes.  Please review.