What are the key Connected App settings that control OAuth behavior: Callback URL, OAuth Scopes, Consumer Key/Secret, and how does each setting impact security?