Function match_allowed_call 

fn match_allowed_call(
    scopes: &[CallScope],
    to: Address,
    selector: [u8; 4],
    recipient: Option<Address>,
) -> AllowedCallMatch

Pure TIP-1011 matching logic. Extracted so it can be unit-tested.