Support scopes

[axos88]

Once APIs #157 are supported, we also need support for scopes, which can also be connected to roles and permissions.

Upon request of a policy for a user, the granted scopes should also be checked, and the returned permissions be limited to those that are present in the user's permissions, and the scopes requested (basically creating an intersection between the two sets).