Allow apps to register OAuth scopes

In order to allow apps to use their own OAuth scopes for API functionality (e.g. AlekSIS/onboarding/AlekSIS-App-Resint#3), we need a dedicated registry.

django-oauth-toolkit supports implementing arbitrary backends for scopes discovery: https://github.com/jazzband/django-oauth-toolkit/blob/master/oauth2_provider/scopes.py#L49