Add required scope validation

[blumTom]

Problem
When using oauth2.0 the user can choose a subset of the scopes, which are required by the application. In case, the user does not choose all scopes, only a subset of the functionality can be used. This leads to a situation, in which the resource server has to decide whether to accept or reject a request based on the request id and the set of included scopes.

Possible Solution
Inspired by ACLs: Define policies, which map requests to users (optional) and required scopes. Validate if a request is allowed by comparing the given scopes with the scopes, which are required for the given request id and user (optional).

[aeneasr]

Thank you @blumTom ! Unfortunately, we don't plan to add new features to the current state of ORY Keto given that we are working hard on #267

[zepatrik]

Closing because this is addressing legacy Keto.