feat(access-rules): support nested and multi-valued token claims

[Martin187187]

Summary

This PR adds support for nested and multi-valued access-token claims.

Changes

• Adds CLAIMPATH, using RFC 6901 JSON Pointer syntax to select nested values from a verified JWT Claims Set.
• Supports direct scalar-string equality and exact string-array membership with $contains.
• Adds strict casts for using scalar claim values in typed formula operations.
• Defines fail-closed behavior for missing paths, incompatible JSON types, and invalid casts.
• Aligns the BNF grammar, JSON Schemas, diagrams, examples, and artifact validation tooling.
• Adds matching BNF and JSON examples for nested role claims.

Validation

• python tools/validate_spec_artifacts.py
• python -m unittest discover -s tests/query

Closes #55

[github-advanced-security]

QDJVMC found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.