1. Use repo AT-URI as identifier. 2. Use `dom` field rather than `obj` to filter by repository. So now it's "user with role A in repo B can do action D to field C" where `A,B,C,D` are `sub,dom,obj,act`. 3. Manage app-logic rules in embedded csv file which won't be saved in db and load to memory on start. This makes app's global rbac rule change easier as we just need to edit the csv file. Many permission check methods are missing, but should be enough to test this new RBAC enforcer package in spindle. Related issue: <https://tangled.org/tangled.org/core/issues/282> Signed-off-by: Seongmin Lee <git@boltless.me>