Require scopes on a request authenticated by AttestoMCP.Plug.Authenticate.
The plug reads the verified scope list from conn.assigns and checks it with
Attesto.Scope. It does not encode MCP policy; routes choose their own
required scopes.
plug AttestoMCP.Plug.RequireScopes, scopes: [AttestoMCP.Scopes.tools_call()]