Allows the server to return tokens granting partial permissions

[joachimvh]

Needed to resolve the issue when a RS wants to verify if a user has one out of a set of scopes to grant access.

This is a solution to that problem, potentially to be improved/modified/etc. in the future based on needs and conclusions.

Some thoughts/remarks around this idea and implementation:

• My main concern is that in the future this might conflict with wanting to throw a NeedInfo error instead returning a partial token. This is also the reason I put this feature in a separate config that needs to be added to enable this.
• Alternative could be that the client has to indicate in the request that they are OK with receiving a partial result, but the client might not now this.
• A more extreme alternative might be that the RS can do more advanced ticket requests where boolean operators are introduced.
• Currently the output includes a boolean to indicate that a token is partial.

[termontwouter]

Looks fine to me. A parameter to indicate the preference for partial or full permissions is already in my todo, and I believe even has one or two existing approaches

[termontwouter]

Is there an issue already to track the future steps?

[joachimvh]

Is there an issue already to track the future steps?

That would imply there are future steps planned. :D

Best I can do is a "some thoughts if there ever is time to continue working on partial permissions" issue if you want.