Tenant scopes (allowed resources)

[byewokko]

Is your feature request related to a problem? Please describe.
I need to limit the resources that are accessible within each tenant.

Describe the solution you'd like

• Tenants can be assigned roles (or something similar) which will limit the resources that they are allowed to access.
• When creating a new authorized session, the resources granted in the ID token will be limited by the tenant's allowed scope (intersection of the end-user's allowed resources, the tenant's allowed resources and possibly the client's allowed resources).

Edit: Tenant tiers will be managed by the specific product that uses them. Seacat Auth should only implement the allowed resource scopes for tenants.