[Server] Add XrdAccToken authorization plugin for WLCG and SciTokens scopes.

Introduce an ofs.authlib plugin that enforces JWT scope claims from
XrdSecOIDC entity attributes, with automatic WLCG/SciTokens profile
selection via wlcg.ver. Honor issuer-exported base_path and
restricted_path when composing effective paths and gating requests.
Document CERN SSO vs WLCG IAM setup in the plugin README.

Author: apeters1971

src/CMakeLists.txt

@@ -123,4 +123,5 @@ if( NOT XRDCL_ONLY )
   add_subdirectory( XrdHttpCors )
   add_subdirectory( XrdCeph )
   add_subdirectory( XrdSciTokens )
+  add_subdirectory( XrdAccToken )
 endif()

src/XrdAccToken/CMakeLists.txt

@@ -0,0 +1,33 @@
+unset(BUILD_ACCTOKEN CACHE)
+
+if(XRDCL_ONLY)
+  return()
+endif()
+
+set(BUILD_ACCTOKEN TRUE CACHE INTERNAL "")
+
+set(XrdAccToken XrdAccToken-${PLUGIN_VERSION})
+
+add_library(${XrdAccToken} MODULE
+  XrdAccTokenAccess.cc
+  XrdAccTokenScope.cc
+)
+
+target_include_directories(${XrdAccToken}
+  PRIVATE
+    ${CMAKE_SOURCE_DIR}/src
+)
+
+target_link_libraries(${XrdAccToken}
+  PRIVATE
+    XrdUtils
+    XrdServer
+    ${CMAKE_DL_LIBS}
+)
+
+if(NOT APPLE)
+  target_link_options(${XrdAccToken} PRIVATE
+    "-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/export-lib-symbols")
+endif()
+
+install(TARGETS ${XrdAccToken} LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})