The refresh_token grant should just reuse the scopes of the previously issued access token

[morvans]

First attempt to tackle #1117.

[Sephster]

Thanks for your PR. Unfortunately this issue can't be fixed without a breaking change. The refresh token currently derives its scopes from the attached access token. The access token can have fewer scopes than the original refresh token so we need to adjust the way scopes are assigned to the refresh token which will cause a BC break. Thanks for your PR but unfortunately we won't be able to go further with this just now.