Allow modifying scopes in AuthorizationRequestResolveEvent

[Amunak]

Sometimes there's a need to allow the user to select optional scopes to allow or exclude from any given AuthorizationRequest.

We already have a good event to hook into to let the user decide whether they want to permit an OAuth connection or not, but there is no option in this (or later) event to modify the scopes.

This PR attempts to address that.

[chalasr]

Looks sensible to me, thanks for the PR. Could you add some test?

[Amunak]

Could you add some test?

I'm not really sure how or what to test - it appeared to me that events aren't tested at all, so there's no good place to add this without also testing the events.

Obviously I could add a unit test for the setter but that doesn't really help much. For what it's worth I actually tested this solution and it worked so unless I botched copying it it should be fine.