OAuth2Application should have scope

[hickford]

Feature Description

OAuth2Application should record scope at registration.

OAuth2Grant scope should then be restricted to a subset of application scope.

This security improvement is especially valuable for public clients which are inherently vulnerable to client impersonation.

The consent screen should list the application scope https://imgur.com/a/7RRUPES

Screenshots

GitLab has this feature https://docs.gitlab.com/ee/integration/oauth_provider.html

GitHub does not

[hickford]

Previous work that added scope to grants and access tokens @aunger #4300 and @jolheiser #20908

[harryzcy]

Referencing #24767, where tokens are redesigned

[lunny]

Those are access_token, but this one is for application token

[strk]

Are "scopes" what would let me only grant "read_email" to an application token ?
If so, this is what we'd need to be happier about allowing our users to login via Gitea to Discourse: https://discourse.osgeo.org/t/psc-vote-lets-move-this-list-to-discourse/6528/26