Fix oauth2_response:to_proplist/1 for correct scoping according to RFC6749 section 3.3

Scopes should be expressed as a list of space-delimited, case-sensitive strings.
Also refactored oauth2_response_tests:to_proplist_test/0 to a property-based PropEr test.