repospawner: mark the account restricted

Defense in depth for the repo-creation bot: a restricted Gitea account can
only see repositories and organisations it is explicitly added to, so a
leaked repospawner token cannot enumerate or read the rest of the estate.
The repospawner team grant on terraform-git already covers everything the
bot does, so nothing it needs is lost.

config/git.unkin.net/user/repospawner.yaml

@@ -15,5 +15,8 @@ description: "repospawner service identity -- opens repo-creation PRs against te
 # profile visible only to signed-in users.
 visibility: limited
 admin: false
+# Restricted: account can only see repos/orgs it is explicitly added to -- the
+# repospawner team grant on terraform-git is all it needs.
+restricted: true
 allow_create_organization: false
 max_repo_creation: 0