Running with least-priv user

[grtjn]

Perhaps something to add to the README. You can run taskbot with a non-admin user, using the following role and amps (provided in Roxy ml-config format):

<role>
  <role-name>${app-name}-amp-role</role-name>
  <description>A role for all amps of the ${app-name} application</description>
  <privileges>
    <!-- required by taskbot -->
    <privilege>
      <privilege-name>xdmp:invoke</privilege-name>
    </privilege>
    <privilege>
      <privilege-name>xdmp:get-server-field</privilege-name>
    </privilege>
    <privilege>
      <privilege-name>xdmp:set-server-field</privilege-name>
    </privilege>
    <privilege>
      <privilege-name>xdmp:spawn</privilege-name>
    </privilege>
  </privileges>
</role>

<amp>
  <namespace>ns://blakeley.com/taskbot</namespace>
  <local-name>maybe-fatal</local-name>
  <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri>
  <db-name>${modules-db}</db-name>
  <role-name>${app-name}-amp-role</role-name>
</amp>
<amp>
  <namespace>ns://blakeley.com/taskbot</namespace>
  <local-name>FATAL</local-name>
  <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri>
  <db-name>${modules-db}</db-name>
  <role-name>${app-name}-amp-role</role-name>
</amp>
<amp>
  <namespace>ns://blakeley.com/taskbot</namespace>
  <local-name>fatal-set</local-name>
  <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri>
  <db-name>${modules-db}</db-name>
  <role-name>${app-name}-amp-role</role-name>
</amp>
<amp>
  <namespace>ns://blakeley.com/taskbot</namespace>
  <local-name>spawn-function-with-policy</local-name>
  <doc-uri>/ext/mlpm_modules/taskbot/src/taskbot.xqm</doc-uri>
  <db-name>${modules-db}</db-name>
  <role-name>${app-name}-amp-role</role-name>
</amp>

Note: depending on what happens in the spawned function one provides oneself, one may need additional application specific privs..