Description/Steps to reproduce

In #3313, I laid ground work for implementing scopes-based authorization. To make this implementation a first-class citizen in LoopBack world, we need to:

• Agree on how to define scopes at app/model level - see the discussion in Add support for scoped access tokens #3313 for more details
• Implement this solution
• Write documentation (see Describe Authorization scopes loopbackio/loopback.io#338 for a starter)

Next steps to consider:

• Consider integration with our CLI tooling and lb acl
• Should we describe the scopes in the Swagger document generated by loopback-swagger? (see Add support for scoped access tokens #3313 (comment))

cc @raymondfeng @ebarault @drmikecrowe

Additional information