Function resolve_matching_grants 

pub fn resolve_matching_grants<'a>(
    scope: &'a ChioScope,
    tool_name: &str,
    server_id: &str,
    arguments: &Value,
) -> Result<Vec<MatchedGrant<'a>>, ScopeMatchError>

Resolve the set of grants that authorise a tool invocation on the given server.

Returns the matched grants sorted by decreasing specificity (exact-exact first, then exact-wildcard, then wildcard-wildcard; ties broken by grant-list order).