rosie create: configurable default access-list

The default is not to set an `access-list`, (which means that only the owner would be allowed to commit to the trunk).