Add oauth scopes

[JobDoesburg]

Closes #137

[KiOui]

All API requests to the server now fail as we need a Token with scope, we should change this to TokenHasScopeOrLoggedIn or something like that.

[KiOui]

It might be nice to also change the documentation to use the OAUTH scopes instead of the permissions we signed in the backend. Can we only let people with baker permissions request the orders:manage scope or something like that?

[JobDoesburg]

It might be nice to also change the documentation to use the OAUTH scopes instead of the permissions we signed in the backend.

The permissions we require are Django permissions. It's different from OAuth scopes (although, yes, they are related). The conventions for naming them are different. For example, the app.permissions is something we cannot deviate from as this is the way Django names their permissions. The OAuth standard however requires the app:scope convention.

Can we only let people with baker permissions request the orders:manage scope or something like that?

No, at least not in a default way. As you can see, the scopes secretly are just strings, they are not really registered in any form. An API can actually request scopes that don't even exist. The only place we could check that is by overriding the OAuth authorization view, which I think is out of scope (pun unintended) for this project.

[KiOui]

I also committed a small typo change (you forgot a comment somewhere)