Role and scope management / authorization model for MXCP

[bgaidioz]

MXCP issues its own access token containing a set of MXCP-defined scopes, and validates those scopes before executing a tool.
For example, a tool that performs database writes would require the mxcp:db:write scope before running.

Not all users should be able to obtain that scope when connecting. For instance, only designated administrator users should receive tokens including mxcp:db:write. This implies the existence of a role and policy management component that maps users (or user roles) to the scopes they are authorized to receive. As a result, each user’s token only contains the scopes that correspond to their permissions, ensuring they cannot gain more privileges than allowed.