Use `dom` field rather than `obj` to filter by repository. So now it's "user with role A in repo B can do action D to object C" where `A,B,C,D` are `sub,dom,obj,act`. spindle user ACL and repository collaborator ACL are slightly different models. For example, from spindle, it should be able to `InviteOnly` config when unspecificed. rbac/v2 can be removed one we use repo-did as delegated account see: <https://tangled.org/tangled.org/core/issues/701> Signed-off-by: Seongmin Lee <git@boltless.me>