[BC break] Rename scopes to scope in JWT payload

This is properly scope per the RFC.

Ack, you're right, I should not farm the issue queue on no sleep. Thank you.

This is a BC break so marking as such.

Marking major since this is out of spec compliance.

So I'm actually a little torn on this; the OAuth 2 standard is actually silent on the claims in a JWT used as an auth token, because auth token contents are up to the implementation. See RFC 6750, et. al.

However, scope is registered in the IANA claim names registry, but only in the context of token exchange. I actually implemented this extension grant time on a Drupal site recently, so I'm familiar with the flow. However, most people don't implement this nor do they care where the standards come from.

I'm apt to change this "anyway," but I do want to be on the record here saying it is a choice, and is likely to be a disruptive change for someone out there. That said, I think this is the right thing to do, especially as it is in line with the token exchange RFC as well.

See draft release note for 5.1.0: https://www.drupal.org/node/3255523

It's also worth noting that we probably fall short of the spec when it comes to returning a response parameter (not to be confused with the JWT claim) when requested scopes are not granted for some reason. I've noted this at https://www.drupal.org/project/simple_oauth/issues/2958159#comment-14355254

Committed to 5.1.x.