onPluginMessageReceived

Handles the proxy's grant.

The player argument is the connection the message arrived on, not its author: on a backend, plugin messages on a registered channel are delivered by the proxy.

When this backend is configured for Velocity modern forwarding it already holds the forwarding secret, so it requires the grant to be signed with it. That is what stops an attacker simply omitting the signature to dodge the check. Networks without a secret — legacy forwarding and BungeeCord — accept an unsigned grant, because no shared secret exists there to do better with.