Function validate_capability 

pub fn validate_capability(
    decl: &CapabilityDeclaration,
    granted: &PermissionSet,
) -> Result<(), String>

Validate a CapabilityDeclaration against the granted permission set.

Rules — generic, no enumeration of capability kinds:

• kind must be non-empty.
• name must be non-empty.
• Every string in permissions must parse to a known crate::extensions::permissions::Permission.
• Every parsed permission must be present in granted.