Add new client.Headless struct for backend application authentication, still in testing phase for this.

Add basic scopes support. Not all scopes are implemented yet, but these will be consumed by the various authorization logic to set which scopes you want when requesting user authorization.

Separate out some of the logic in client.go into auth/ and user/ to clean up the root package. Export a few new functions to limit the number of subpackages consumers need to import.