How does an issuer manage trustlines when authorization is required?

well, although it's been a while but since I'm just crossing the same situation worth noting that an Authority of an [Asset] (Issuer/Distributor) or any other [Account] the holds an amount of the so-called [Custom Asset] with "AUTHORIZATION_REQUIRED is set to True" needs to retrieve a list of [Pending Trustlines] and verify them based on it's own specifications, then Authorize/Disauthorize their [Trustline] by sending an [AllowTrust] Operation to the Network. (Retrieving the list of [Pending Trustlines] is my current challenge though).

The issuer/anchor will have to figure out a process for that, and it can vary significantly depending on their compliance process.

For example, an anchor may require a customer to register on their website providing KYC information (along with their stellar address), and if everything checks out, they'd execute the Allow Trust operation on the address.

With Lumen you can do this:

$ lumen flags BankOfCanada auth_required

# Bob creates a new trustline to CAD.
$ lumen trust create bob CAD:BankOfCanada 1000

# Bank-of-canada authorizes it.
$ lumen trust allow bob CAD:BankOfCanada --signers BankOfCanada

You can read more about this here.