uses the reserved header <code>"@request.auth.claims.groups"</code> to match with the JWT claim <code>groups</code>.
The prefix <code>@</code> denotes it is matching with the metadata derived from the JWT validation and not with HTTP headers.</p><p>Claim of type string, list of string and nested claims are supported. Use the <code>.</code> or <code>[]</code> as a separator for nested claim
names. For example, <code>"@request.auth.claims.name.givenName"</code> or <code>"@request.auth.claims[name][givenName]"