Previously knot.go executed every sh.tangled.pipeline event the
moment it arrived, ignoring the spindle_members and repos
tables that jetstream.go has been mirroring from the AT Proto
firehose.
The knot consumer now consults store.AuthorizePipelineActor
before dispatching a trigger. The check has two gates: the
triggers repo must have published a sh.tangled.repo record
naming us as its spindle on the knot the event arrived from, and
the publisher of that repo record must be either the spindle
owner or a subject the owner vouched for via
sh.tangled.spindle.member.