feat: gate oauth2 authorization on per-client roles

config/packages/league_oauth2_server.yaml

@@ -19,6 +19,9 @@ league_oauth2_server:
         doctrine: null
     client:
         allow_plaintext_secrets: false
+        # App\Entity\OAuth2Client adds the required_roles column that
+        # App\EventListener\AuthorizationCodeListener gates authorization on.
+        classname: App\Entity\OAuth2Client
 
 when@test:
     league_oauth2_server: