Create multiple OAuth scopes

Report https://news.ycombinator.com/item?id=11206661

@vsizov worked on this but we decided not to do it at the time, but I think we're open to contributions.

Tasks

• Allow Personal Access Tokens to be scoped (assuming !3749 (merged) has been merged in) (edit: moved this to #18369 (closed))

References / Notes

• Related to personal access token scopes: #18369 (closed)
• Some thoughts on implementation: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3749#note_12210651