Feature Request: API key scopes/permissions

[TheOneironaut]

I want to connect an AI agent (LLM-based) to WhatsApp using WAHA + GOWS engine.
The AI should only read incoming messages and react accordingly through my own backend logic.

The big problem is: once the session is connected, the AI (or any code with API access) can potentially call send endpoints and perform unwanted actions (sending messages, editing, deleting, etc.).
I need a way to completely prevent any outgoing actions at the WAHA level, so even if the AI goes rogue or there's a bug in my prompt/code, it physically cannot send anything.

[devlikepro]

There are two ways to handle this:

1. Add MCP with scopes: [MCP] Add MCP server #1925
2. Add scopes for API keys, so that the API has access only to "secure" APIs.

Let's work on adding permissions/scopes for API keys in this issue 👍