[gnap] access policy config option to only allow TokenAccess references

[Moopli]

If the access policy can be configured to only allow reference TokenAccess requests, then we can more tightly control exactly what access combinations are granted - rather than default logic of allowing requests that ask for custom subsets of already-granted access rights - and we can precompute the decisions of what access rights contain other access rights.