[OAuth] Add feature to limit apps to groups

We could use a feature to limit the use of app credentials to selected groups if using a grant flow that authenticates as a user (all but Client Credentials).