RFC on authorisation model

This gives a baseline for future changes, e.g., expanding where
namespace ACLs are used, switching access control to
untrusted-by-default.

The "Security considerations" section  was adapted from

    https://github.com/fluxcd/flux2/pull/2086



Signed-off-by: Michael Bridgen <michael@weave.works>