Allow get_access_token to return tokens with multiple scopes

[mhammond]

This brings mobile in line with desktop. Multiple scopes can be specified. These scopes are normalized and used as the cache key.

Split into 2 commits for ease of review:

• first patch with the changes
• second patch splits the access token code and tests into its own module, so oauth.rs stays a sane size. This commit has no actual functionality change.

Pull Request checklist

• Breaking changes: This PR follows our breaking change policy
  • This PR follows the breaking change policy:
    • This PR has no breaking API changes, or
    • There are corresponding PRs for our consumer applications that resolve the breaking changes and have been approved
• Quality: This PR builds and tests run cleanly
  • Note:
    • For changes that need extra cross-platform testing, consider adding [ci full] to the PR title.
    • If this pull request includes a breaking change, consider cutting a new release after merging.
• Tests: This PR includes thorough tests or an explanation of why it does not
• Changelog: This PR includes a changelog entry in CHANGELOG.md or an explanation of why it does not need one
  • Any breaking changes to Swift or Kotlin binding APIs are noted explicitly
• Dependencies: This PR follows our dependency management guidelines
  • Any new dependencies are accompanied by a summary of the due diligence applied in selecting them.

[bendk]

Looks good to me. I had a small suggestion, but no need for re-review.

[bendk]

Nit: Now that we have normalize_scopes, I think this could just be let requested_scopes: Vec<&str> = requested.split_ascii_whitespace().collect().