Previously, observing a sh.tangled.repo record whose spindle field
matched our hostname was enough to enroll a new knot subscription, no
matter who published the record.
reconcileKnot now consults a new IsAuthorizedActor helper before
calling AddKnot: the repo's publisher DID must be the spindle owner
or have been vouched for by a sh.tangled.spindle.member record
whose own publisher is the owner.