Implement Resource Owner Password Credentials Grant

This is described in section 4.3 of the specification
(http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.3).

We want the authentication of the resource owner credentials to be
pluggable, so we introduce a new Spring bean for that purpose.  We also
supply 2 initial implementations:

* A no-op version that authenticates any username/password given (except for a well known "bad" user).

* An implementation that stores the known resource owners and their credentials in the authorization server's database.

Cleaned up the confirmation of the client credentials a bit since we only
seemed to really be doing that fully for the client credentials grant (and
we should anytime they are provided).

Added tests for the new code (though more testing could easily be done, I
tried to match the level of the existing code).
Use client scopes if none are requested.
Update client credentials grant to use request scopes if available.

I put this code in for the password case, but it can be used for the
client credentials grant as well (which had a TODO along those lines).
DefaultPackagesResourceConfig is useless

As the SprinServlet will register all resources due to the @ComponentScan
annotation.
Added Apache V2 license and notice.
Add .editorconfig in an attempt to help people not destroy formatting.
Correct editorconfig settings for .js and .css files
Move to java 7
Return token-scopes separated by a space character, as per the spec.
Merge branch 'sfitts-smf-add-password-grant'