Restrict user authorization to shoulders

[jfinkhaeuser]

It's a bit of an advanced feature, but: shoulders exist to effectively namespace concerns within a NAAN.

In the use case I have, I have largely independent teams maintaining ARKs for different concerns. Therefore it would make sense to restrict authorization to manage ARKs to one or more shoulders within a NAAN.