Expose scope to token and code authorization grants

I need the requested scope when I'm creating the access token.

This can also be implemented by storing the scope in the session before rendering the dialog and retrieving it in the decision parser, but since oauth2orize already do this, why not just expose it?

I expects you want some documentation and tests. Will look at that after approval.

Also, maybe exposing `txn.req` is better?