Add a permission model to appsettings.json that controls which HTTP methods (GET, POST, PUT, DELETE, PATCH) are allowed for each key. By default, all methods are allowed, but permissions can be explicitly set to true or false per method. This requires updates to both the application code and the configuration tool. Example: a key user1 with a hashed secret and permissions where only GET is allowed, while POST, PUT, and DELETE are disabled