Move Roles:Scopes association out of database

[danielballan]

Following JupyterHub's example, we store the list of Scopes assigned to each Role in the authentication database. This table is populated and database creation time and sometimes updated with new releases (i.e. as new Scopes are added). It is possible for administrators to add custom Roles with custom Scopes, or to alter the Scopes on one of the built-in roles. Since JupyterHub has this feature, it seems plausible that we might want it.

But would it be better to move this state out of the database and into the config.yml? It is really necessary to modify this without a server restart? Would it be simpler to, instead, simply hard-code the default roles and scopes and allow them to be overridden and/or extended in config.yml?

Suggested by @dmgav