You can do most of what you want without writing code.
Basic structure: Each of the 10 DIDs has an Inbound Route pointing to a corresponding Virtual Extension. Each Virtual Extension has Call Forwarding Unconditional set, pointing to the desired destination.
The feature code Call Forward All Prompting Activate (default *93) allows you to specify the extension to forward and the corresponding destination.
You could set up a Custom Destination that executes *93 and set the Inbound Route for the 11th DID (and proper CID) to point there.
With a loopback trunk and PIN Sets, you could add authentication. I don’t see a code-free way to allow specific caller IDs to modify only some of the destinations, though the Virtual Extension numbers could be ‘secret’ and told to only those authorized.
If you do need to write custom dial plan code, put it in extensions_custom.conf and point your Custom Destination there. You can use the code for *93 as a guide for what is required.
extensions_additional.conf should not be modified, as it is rewritten by FreePBX whenever an Apply Config is done.
You can do most of this with the dynamic routes module. Use it to check Cid, challenge for a pin, get forwarding dest and then set an astdb value. Use a custom dest to send callers to the astdb value.