v11.3.2

Fixed

• Compare allowedAction sets, not JSON types, when checking that a delegated
  capability is no less restrictive than its parent. A child ['write'] under
  a parent 'write' is now accepted.
• Enforce the root capability's allowedAction against the first delegated
  link during chain verification. Previously only delegation-time validation
  checked it, so a verifier accepted a delegated zcap that widened the root's
  actions.