mod_restrict_federation: Allow some ad-hoc commands used by push services This fixes push registration for Siskin, Conversations and Snikket Android+iOS when used by restricted accounts.

This module blocks configured queries that change server state.

E.g. to make vCard storage read-only:

``` lua
readonly_stores = {
	vcard = { "vcard-temp", "vCard" };
}
```