update type of scopes for ClientCredentialsAuthorizer

[aaschaer]

Ran into this while linting client credentials work for the CLI.

The ClientCredentialsAuthorizer was being too strict in the allowed types for scopes since they are just being passed to oauth2_client_credentials_tokens which accepts Optional[Union[str, Iterable[str]]]

[sirosen]

This looks very much okay / reasonable to me.

I do want the :pr: link in the changelog. Either as suggested or just amended to

:pr:`498`

I also just noticed that it might be a good idea to double-backtick the union type in the changelog, as

``Union[str, Iterable[str]]``

With the changelog entry minimally edited, I'm happy to merge. We can get a release out shortly.