Document expected shape of tokenized additional_scopes_key

The list clause of `extract_scopes_from_additional_scopes_key/2` accepts
any list, but only the `[[binary()]]` shape produced by the schema
tokenizer is correct: an outer list of paths, each a list of segment
binaries. A hand-written single-level list of binaries is silently
treated as several top-level paths rather than one nested path.

Add a comment recording this so future readers of advanced.config
values understand the convention.

Author: lukebakken

deps/rabbitmq_auth_backend_oauth2/src/rabbit_auth_backend_oauth2.erl

@@ -423,6 +423,11 @@ extract_scopes_from_additional_scopes_key(
     AdditionalScopes = [ extract_token_value(ResourceServer, 
         Payload, Path, fun extract_scope_list_from_token_value/2) || Path <- Paths],    
     set_scope(lists:flatten(AdditionalScopes) ++ get_scope(Payload), Payload);
+%% Paths is expected to be a list of pre-tokenized paths, each itself a list of
+%% segment binaries, e.g. [[<<"realm">>, <<"roles">>]]. This is the shape produced
+%% by rabbit_oauth2_schema:tokenize_additional_scopes_key/1 from rabbitmq.conf.
+%% A single-level list of binaries is treated as several top-level paths, not one
+%% nested path.
 extract_scopes_from_additional_scopes_key(
         #resource_server{additional_scopes_key = Paths} = ResourceServer, Payload)
           when is_list(Paths) ->