Function capability_request_requires_dpop 

pub fn capability_request_requires_dpop(
    cap: &CapabilityToken,
    tool_name: &str,
    server_id: &str,
    arguments: &Value,
) -> Result<bool, KernelError>

Return whether any grant matching this tool request requires DPoP.

A request with no matching grant returns Ok(false). Callers that need authorization should pair this with capability_matches_request.