We should validate ClientRegistration.scopes to ensure it contains valid characters as per spec.

Related spring-boot#15398