vdu: allow {role:".."} in maintainers list

Treats any user with the specified role in their "roles" list to update
the package doc.

Part of MVP of group authorization management.  Groups must still be set
via a server admin, so the API for managing groups will probably need to
be outside of the Couch App itself.
entity-scoped modules

Syntax: `@entity/module-name`

This is just the bare minimum validate_doc_update function change that
is required to support scoped modules.

Even if they are in the maintainers list, users must *also* have the
entity set as a role in their user doc to make changes.
move name validation from update function into vdu where it belongs