Consider new Client setting: AllowedResources

[brockallen]

In the validator, simply check if the requested resources are in the allowed resources list.

Could be used with or without allowed scopes.