add configuration "grant_flows"

defaults to all grant flows + 'refresh_token'
Hint default grant flows in initializer template
check for available strategies before processing on endpoints
completely turn off disabled strategies on token endpoint (see note)

Note: I'm not sure whether this is necessary, as there is already a
validation in Doorkeeper::Request.
test that refresh_token request returns unsupported_grant_type error when it is not enabled explicitly.