WLCG JWT profile - group OR scope authorization