store scopes on oauth clients, too

rather than roles, matching tokens

because oauth clients are mostly involved with issuing tokens,
they don't have roles themselves (their owners do).

This deprecates the `oauth_roles` config on Spawners and Services, in favor of `oauth_allowed_scopes`.

The ambiguously named `oauth_scopes` is renamed to `oauth_access_scopes`.

examples/custom-scopes/jupyterhub_config.py

@@ -7,7 +7,10 @@ c.JupyterHub.services = [
         'name': 'grades',
         'url': 'http://127.0.0.1:10101',
         'command': [sys.executable, './grades.py'],
-        'oauth_roles': ['grader'],
+        'oauth_allowed_scopes': [
+            'custom:grades:write',
+            'custom:grades:read',
+        ],
     },
 ]