[OAuth] Allow apps to generate claims for their own scopes

Currently, all claim data is generated in the validator.

We need to allow apps to fill in data for their own scopes.