refactor: relax specific scope naming requirements

[brownoxford]

This PR seeks to resolve issue #457 by relaxing the scope-related requirements for conformance via the following changes:

• Conformance testing no longer requires that OAuth2 providers grant ONLY those scopes requested
• Conformance testing no longer requires that specific scopes be present in order to pass testing
• Default behavior assumes that OAuth2 provider includes all scopes granted to a client ID in the JWT token
• Override behavior allows implementations to provide a list of scopes that client should request via the CLIENT_SCOPE configuration variable.

A brief summary of code changes:

• All tests for missing_scope have been removed.
• Tests which require authentication no longer individually specify which scopes should be requested
• Sample environment configuration now includes CLIENT_SCOPE variable
• Library function getAccessToken() no longer accepts a scope argument and manages which scopes are requested based on CLIENT_SCOPE environment variable.

If we approve this PR, the following additional work will need to be done:

• Modify interoperability tests as needed
• Update documentation and respec as needed

Fixes #457
References #500

[nissimsan]

Leaving this for next week and further discussion.

[mkhraisha]

Very happy to see this!

[brownoxford]

Created #550 and #551 to address scope related documentation change requirements.