@RegisteredOAuth2AuthorizedClient should support upgrading scopes

Summary

A @RegisteredOAuth2AuthorizedClient should be able to have the scopes necessary to make a particular request. If the scopes are not present on the access token, it should support automatically requesting the additional scopes. This will allow a client to request the fewest possible scopes necessary without needing to provide additional code when needing to request more scopes.

For example, if a ClientRegistration has the scopes user, message, and admin associated to it a user should be able to state something like @RegisteredOAuth2AuthorizedClient(scopes = { "message" }). If the current access token associated to the registration had the user scope and not the message scope, then Spring Security would trigger the flow that would ensure the access token had user and message scopes.

We should also ensure that we can get tokens where the scopes are not additive. For example, for the scenario above we might have something like @RegisteredOAuth2AuthorizedClient(onlyScopes = { "message" }). Then an access token that is passed along would only contain the message scope and not the user scope despite the previous associated token having a user scope.

Start by tracing the @RegisteredOAuth2AuthorizedClient entry point and the existing authorized-client scope handling. Define how additive and non-additive scope requests should behave, then verify that tokens are refreshed or requested with the required scopes and that both annotation forms are covered by tests.