feat: restrict builtins, aqua-ipfs, worker-spell alias [NET-551,NET-730,NET-729,NET-792]

[kmd-fl]

Description

Forbid usage of several builtins, aqua-ipfs service and worker-spell alias.

Motivation

Only Host and Worker Spells (and a host manager) should be able to call important built-ins like Srv.create or Worker.create.

Proposed Changes

1. Make some builtins available only to Host, Worker-Spell, and Host Manager (Here's the list of all protected builtins)
2. Make aqua-ipfs available only to Host, Worker-Spell, and Host Manager.
3. Allow calling services and spells worker-spell only Host and Host Manager
4. Fix incorrect spell resubscription for workers

Additional Notes

• We shouldn't forget to design a nice permission system when we'll be discussing nox re-design later. It's really easy to miss now an important if is_host when it's needed.

[linear]

NET-551 Restrict worker.create

NET-730 Restrict spell.install

NET-792 Allow aqua-ipfs usage only for installation-spell

NET-729 Restrict srv.create