OAuth 2: support variable expansion for topic authorisation

[OLibutzki]

Currently variable expansion is only supported by the internal authorisation backend. As discussed with @ansd here, it makes sense in the context of rabbit_auth_backend_oauth2, too.

As a practical example, I currently have to add a lot of client scopes in order to build specific permissions per user. Having a Client scope which contains {username} would easy this setup a lot.

[MarcialRosales]

The expansion variables could be:

• username whose value is determined by the Preferred username claims
• vhost
• or probably any claim of type string. For instance, sub or client_id. Most likely if there is a username claim, it is going to be part of one of Preferred username claims

Examples:

Given a token with the claim client_id: abz and scope rabbitmq.read:*/{client_id}-* means it has read access on any queue whose name starts with abz- on any vhost.

[ansd]

Given a token with the claim client_id: abz and scope rabbitmq.read:/{client_id}- means it has read access on any queue whose name starts with abz- on any vhost.

@MarcialRosales this feature request is only about topic authorisation - not about queues.

[OLibutzki]

Using any claim of type string would be great as it makes the solution much more flexibel.