CVE-2026-32716: SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking

The Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass.