Use an object to describe permission instead of strings

[thiagodelgado111]

Hey folks, I noticed that we should use something like resource:scope for specifying the resources and scopes we want to enforce the user has access to. Although splitting a string based on : might not work depending on the resource name. If you are using your own URN, as an example, it would yield weird auth requests.

I think extending the current format to accept resource and scope as an object or an array of string arrays might easily solve that