Add support for escaped . in authz validation requests

[sdewhitt]

This PR lands after both #159, #160, and rabbitmq-server 16985 merge.

rabbitmq-server 16947 brought to light issues with how "." splitting is handled, and rabbitmq-server 16985 adds support for escaping dots (like \.). Since said PR introduces such a change to the upstream OAuth backend, there needs to be proper support on the validation endpoint to maintain parity.

Background

The upstream OAuth backend resolves additional_scopes_key by splitting the key on . into a nested-map path (rabbit_auth_backend_oauth2:split_path/1). A flat claim key that itself contains dots — e.g. an STS/OIDC key like https://sts.amazonaws.com/tags — is therefore split into ["https://sts", "amazonaws", "com/tags"] and never found. rabbitmq-server#16985 fixes this by:

• adding an escaped form \. (a literal dot in a segment) via rabbit_oauth2_schema:tokenize_additional_scopes_key/1, which produces a pre-tokenized [[binary()]] (list of paths, each a list of segments); and
• teaching the record's additional_scopes_key to accept that list form directly (a new is_list/1 clause on extract_token_value/4 / extract_scopes_from_additional_scopes_key/2), so a pre-split key is consumed without being re-split.

Because the validation endpoint replays the broker's real scope-resolution code, it must interpret additional_scopes_key identically — otherwise an escaped key that the live broker would resolve would be reported as authz_unverified, breaking parity in the safe-but-misleading direction.

This PR adds said support by:

• Delegating tokenization to the broker's own rabbit_oauth2_schema:tokenize_additional_scopes_key/1 rather than reimplementing the escape logic. This keeps the same "execute the broker's code, don't mirror it" guarantee the authz layer already relies on: the endpoint splits additional_scopes_key byte-for-byte the way auth_oauth2.additional_scopes_key does in rabbitmq.conf, so an escaped \. stays a literal dot in a flat claim name and an unescaped . remains a nesting separator.
• Confining the change to aws_auth_validate_oauth_authz:evaluate/3 (a new tokenize_additional_scopes_key/1 helper that the record overlay routes through). The pure parse phase in aws_auth_validate_oauth is untouched — it still validates additional_scopes_key as a plain binary and never depends on the OAuth backend being loaded.
• Keeping the request contract unchanged. Callers still send additional_scopes_key as a plain string; allowed_fields/0, the shape validation, and the response categories are all unchanged. This is purely additive — no new fields, no new statuses.
• Falling back gracefully on pre-fix broker series. When rabbit_oauth2_schema:tokenize_additional_scopes_key/1 is not exported (a broker without rabbitmq-server#16985), the helper passes the raw binary through unchanged, so normalize_token_scope/2 takes its existing binary/split_path/1 clause and the endpoint behaves exactly as it does today. The feature stays available on old brokers; it simply lacks escaped-dot support there, matching what those brokers themselves can do. No change to the HAVE_OAUTH2_RESOURCE_SERVER compile gate or available/0.
• Guarding against load order. The helper calls code:ensure_loaded/1 before erlang:function_exported/3 (a bare function_exported returns false for a beam that is on the path but not yet loaded, which would make escaped-dot support depend on load order — the same trap available/0 already documents).
• Preserving parity in both directions, verified by tests:
  • authz_escaped_dotted_additional_scopes_key_test_ (new) — an escaped key https://sts\.amazonaws\.com/tags resolves the flat claim and grants (ok). Double-gated on maybe_skip_authz/1 (the arity-4 scope API) and tokenizer presence, so it skips cleanly on a pre-fix broker rather than failing.
  • authz_dotted_additional_scopes_key_parity_pin_test_ (from OAuth Authz validation parity test enhancements #160) — an unescaped key still splits and does not resolve a flat dotted claim (authz_unverified). Its comment is corrected to state that the fix adds an escaped form; it does not make unescaped dots resolve a flat key.

Verification

• gmake eunit t=aws_auth_validate_oauth_tests — all tests pass; escaped→ok and unescaped→authz_unverified confirmed executing (not skipped) with the fixed OAuth backend on the code path.
• Manually exercised end-to-end through PUT /api/aws/auth/validate/oauth against a broker built with rabbitmq-server#16985: same token carrying a flat dotted claim, escaped additional_scopes_key → 204, unescaped → 422 authz_unverified.
• erlfmt -c clean.

Notes for reviewers

• Stacking / merge order: this branch is cut on top of OAuth Authz validation parity test enhancements #160, so until OAuth Authz validation parity test enhancements #160 lands, a diff against main shows both the parity-pin commit (OAuth Authz validation parity test enhancements #160) and the escaped-dot commit. Land order is Hardening/auth validation parity followups #159 → OAuth Authz validation parity test enhancements #160 → (rabbitmq-server#16985 upstream) → this PR.
• Draft until the upstream dep lands. The tokenizer this PR calls (rabbit_oauth2_schema:tokenize_additional_scopes_key/1) only exists once rabbitmq-server#16985 merges. Its signature/return shape should be re-confirmed before this PR leaves draft, since the upstream implementation may still change.
• CI coverage caveat: the escaped-dot test only executes where the tokenizer is present; against a pre-#16985 OAuth backend it skips (by design). Green CI proves the escaped path only when CI builds against a broker series that includes the fix.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.