Consider adding an event to the OAuth 2.0 base handler to validate token responses

In some cases, developers want to make sure that the scopes granted by the authorization server/resource owner exactly match the requested scopes. In OAuth 2.0/OIDC, this can be done by determining whether a `scope` property was returned as part of the authorization response (for the implicit flow, but it's easy to bypass) or the token response, and ensuring it matches the requested scopes.

Unfortunately, there's currently no event that would allow implementing that.
Alternatively, if we think it's a common enough scenario, it should be natively implemented as a `ValidateGrantedScope` option.

https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers/pull/444#issuecomment-655032756

/cc @Tratcher @bryantlikes