Merge pull request #22798 from backstage/Rugvip-patch-1

beps/0003: add TODOs for issuing service tokens

beps/0003-auth-architecture-evolution/README.md

@@ -111,6 +111,8 @@ type BackstageCredentials =
 export interface AuthService {
   authenticate(token: string): Promise<BackstageCredentials>;
 
+  // TODO: should the caller provide the target plugin ID?
+  // TODO: how can we make it very difficult to forget to forward credentials
   issueToken(credentials: BackstageCredentials): Promise<{ token: string }>;
 }
 ```