private static Map<String, List<Object>> executeInlineGroovyScript(final RegisteredServiceAttributeReleasePolicyContext context,
                                                                       final Map<String, List<Object>> resolvedAttributes,
                                                                       final String attribute) {
        val scriptFactory = ExecutableCompiledScriptFactory.findExecutableCompiledScriptFactory();
        if (scriptFactory.isPresent() && scriptFactory.get().isInlineScript(attribute) && CasRuntimeHintsRegistrar.notInNativeImage()) {
            val inlineGroovy = scriptFactory.get().getInlineScript(attribute).orElseThrow();
            try (val executableScript = scriptFactory.get().fromScript(inlineGroovy)) {
                val args = CollectionUtils.<String, Object>wrap(
                    "context", context,
                    "attributes", resolvedAttributes,
                    "logger", LOGGER);
                executableScript.setBinding(args);
                return FunctionUtils.doUnchecked(() -> executableScript.execute(args.values().toArray(), Map.class));
            }
        }
        return new HashMap<>();
    }
Return only the collection of allowed attributes out of what's resolved
for the principal.

@author Misagh Moayyed
@since 4.1.0
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/ReturnAllowedAttributeReleasePolicy.java