Add test for sending scope in wrong order

A UK open banking participant has reported that some banks are accepting scope=openid accounts but rejecting scope=accounts openid (or vice versa).

https://tools.ietf.org/html/rfc6749#section-3.3 is clear that the order does not matter. We should add a test that deliberately sends the second variant.