implement allowlist access control using the automerge authors API

[grjte]

This won't work until we update the dependencies in patchwork-next to use the authors versions of the automerge dependencies.

This is a functional update to the repo-bridge and access control which:

1. auto-allowlists documents created by the iframe
2. prompts for documents requested by the iframe which it didn't create and which aren't already on the denylist or allowlist.

It's in draft right now because:

1. we need to update patchwork-next dependencies
2. this is vibe-coded without much review and I think there will be a better way once I have access to a code sample here: https://github.com/automerge/automerge-repo-keyhive/blob/5fea03abf151eb2e94d47d95ce698c2201cc185e/src/keyhive/automerge-repo-keyhive.ts#L403

[netlify]

✅ Deploy Preview for patchwork-base ready!

Name	Link
🔨 Latest commit	3ff85af
🔍 Latest deploy log	https://app.netlify.com/projects/patchwork-base/deploys/6a4e3b2192d0f30008078e62
😎 Deploy Preview	https://deploy-preview-20--patchwork-base.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.