DefaultOAuth2UserService should extract authorities

[jzheaux]

JwtGrantedAuthoritiesConverter is handy in Resource Server for extracting each scope into individual GrantedAuthoritys:

Jwt jwt = Jwt.withTokenValue("token")
    .claim("scope", "message:read message:write")
    .header("alg", "none")
    .build();
JwtGrantedAuthoritiesConverter converter = new JwtGrantedAuthoritiesConverter();
assertThat(converter.convert(jwt)).containsExactly(
    new SimpleGrantedAuthority("SCOPE_message:read"),
    new SimpleGrantedAuthority("SCOPE_message:write"));

It'd be nice if DefaultOAuth2UserService did the same thing by default. Currently, it adds the OAuth2UserAuthority to the list of granted authorities, so this ticket would serve to append several SimpleGrantedAuthoritys to that list.

Note that we should also keep #5349 in mind when completing this feature.