Allow apps to dynamically generate OAuth scopes

This replaces the settings merging for the static
`OAUTH2_PROVIDER["SCOPES"]` setting.

Attention: Breaking change, only release with next major version. Can
be backported to minor release if support for old mechanism is glued
into the new one, with a deprecation warning.

(cherry picked from commit 1aabacae)