Bug in client's scope restriction

If set `scope` column in `oauth_clients` table to empty string, then client allowed to any scope even if it not exists in `oauth_scopes` table.

Author: afilippov1985

src/OAuth2/Controller/AuthorizeController.php

@@ -236,8 +236,8 @@ public function validateAuthorizeRequest(RequestInterface $request, ResponseInte
             // restrict scope by client specific scope if applicable,
             // otherwise verify the scope exists
             $clientScope = $this->clientStorage->getClientScope($client_id);
-            if ((is_null($clientScope) && !$this->scopeUtil->scopeExists($requestedScope))
-                || ($clientScope && !$this->scopeUtil->checkScope($requestedScope, $clientScope))) {
+            if ((empty($clientScope) && !$this->scopeUtil->scopeExists($requestedScope))
+                || (!empty($clientScope) && !$this->scopeUtil->checkScope($requestedScope, $clientScope))) {
                 $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'invalid_scope', 'An unsupported scope was requested', null);
 
                 return false;