Function resolve_capability_grants 

pub fn resolve_capability_grants<'a>(
    capability: &'a CapabilityToken,
    tool_name: &str,
    server_id: &str,
    arguments: &Value,
) -> Result<Vec<MatchedGrant<'a>>, ScopeMatchError>

Convenience wrapper that runs resolve_matching_grants against a full capability token.