cross-knot repo migration #4694

workable task for #267

Tangled repository creation needs two records to be created:

at://did:example:repo/org.tangled.repo.manifest/self
{
  "declaration": { "owner": "did:example:owner", "name": "CoolRepo" }
  ...
}

at://did:example:owner/org.tangled.repo.declaration/coolrepo
{ "repo": "did:example:repo" }

There can be multiple declaration records from various users pointing same repo, ones not matching the repo.manifest are treated as an alias.

When we transfer a repository to new owner, both repository and new owner should verify each other, and once manifest points new owner, the repository will be invisible until new owner attests the ownership by creating a declaration record in their PDS. Because we need two separate writes to two different accounts (repo account & new-owner account,) ownership handover can't happen in just one go.

From user's perspective, handover should complete once new owner accepts the ownership. So changing the owner of CoolRepo from alice to bob will work like this:

1. alice clicks "change owner" button and specify bobbin as new owner
2. web client requests {knot}/xrpc/org.tangled.repo.requestDeclarationChange procedure with following input, service-auth as alice

   {
     "repo": "did:example:cool-repo",
     "owner": "did:example:bob",
     "name": "CoolRepo"
   }
   

3. knot mints a verification token with context of given input. Knot should be able to map this token back to given input.
4. web generates a verification link with this token
5. alice sends the verification link to bob
6. bob clicks the link and login to web client
7. web will automatically create the declaration record for bob
8. once record is ready, notify knot by calling {knot}/xrpc/org.tangled.repo.performDeclarationChange, service-auth as bob including the verification token as input.
9. knot verifies bob was the new owner from requestDeclarationChange input, and modify the org.tangled.repo.manifest record.

Ultimately, flow can be used on repo rename too, but without verification link so users won't notice the change.