[Server] Add XrdAccToken authorization plugin for WLCG and SciTokens scopes.

Introduce an ofs.authlib plugin that enforces JWT scope claims from
XrdSecoauth2 entity attributes, with automatic WLCG/SciTokens profile
selection via wlcg.ver. Honor issuer-exported base_path and
restricted_path when composing effective paths and gating requests.
Document setup with XrdSecoauth2 in the plugin README.

Author: apeters1971

debian/xrootd-plugins.install

@@ -11,3 +11,4 @@
 /usr/lib/*/libXrdSecunix-6.so
 /usr/lib/*/libXrdSecztn-6.so
 /usr/lib/*/libXrdSecoauth2-6.so
+/usr/lib/*/libXrdAccToken-6.so

src/CMakeLists.txt

@@ -127,5 +127,6 @@ if( NOT XRDCL_ONLY )
   add_subdirectory( XrdHttpCors )
   add_subdirectory( XrdCeph )
   add_subdirectory( XrdSciTokens )
+  add_subdirectory( XrdAccToken )
   add_subdirectory( XrdOssMirage )
 endif()

src/XrdAccToken/CMakeLists.txt

@@ -0,0 +1,33 @@
+unset(BUILD_ACCTOKEN CACHE)
+
+if(XRDCL_ONLY)
+  return()
+endif()
+
+set(BUILD_ACCTOKEN TRUE CACHE INTERNAL "")
+
+set(XrdAccToken XrdAccToken-${PLUGIN_VERSION})
+
+add_library(${XrdAccToken} MODULE
+  XrdAccTokenAccess.cc
+  XrdAccTokenScope.cc
+)
+
+target_include_directories(${XrdAccToken}
+  PRIVATE
+    ${CMAKE_SOURCE_DIR}/src
+)
+
+target_link_libraries(${XrdAccToken}
+  PRIVATE
+    XrdUtils
+    XrdServer
+    ${CMAKE_DL_LIBS}
+)
+
+if(NOT APPLE)
+  target_link_options(${XrdAccToken} PRIVATE
+    "-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/export-lib-symbols")
+endif()
+
+install(TARGETS ${XrdAccToken} LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})