Service owner controlled scope per application

### Description

Ability to define a custom scopes per application

### Tasks

- [x] App developers can configure scopes for users in `applicationmetadata.json`
- [x] App developers can configure serviceowner scopes in `applicationmetadata.json`
- [x] Users can override the unauthorized error message
- [x] `[org]` and `[app]` placeholders in configured scopes that we automatically populate
- [ ] Configuration is enforce in Storage
- [x] Configuration is enforced in app
- [ ] Configuration is enforced in localtest
- [ ] Docs
- [x] Update JSON schema for applicationmetadata

### Acceptance Criterias

- Given no scope configuration, no scope authorization should be performed
- Given a configured scope, that scope should be enforced in App and Storage APIs for the resources "belonging" to that app
- Given a request using an apps configured scope, that request can not touch resources belonging to a different app (?)
- Given custom app endpoints (controllers or minimal), any scope configuration should be enforced according to the above
- Scope authorization should be logged during startup in the app (which endpoints are protected by which scopes). Logs are not needed if no scopes are configured