Authorization scope leakage via shared permission mutation

Authorization scope leakage in Apache APISIX allows remote authenticated users to encounter expanded access decisions on protected routes. The authz-keycloak plugin appends each request's HTTP-method scope directly to a static permissions list retained in shared route configuration, so scopes accumulate across requests. The behavior requires both static permissions and http_method_as_scope on a Keycloak-protected route; authorization checks can then use permissions contaminated by earlier requests.