This is not specific to authentication, and allows plugins greater flexibility in what events they are interested in. It also adds message handling, and $CONTROL handling.
Rename mosquitto_plugin_publish() to mosquitto_broker_publish().
These two functions achieve the same thing. *_publish() publishes the payload and frees it later. *_publish_copy() takes a copy of the payload, so the plugin still owns the memory it passed to the function.
Roger A. Light