feat: add the AnyDelegate filter

ci-broker.md

@@ -1234,6 +1234,43 @@ sed -i "s/NODEID/$rid/g" "$yaml"
 ~~~
 
 
+## Filter predicate `AnyDelegate`
+
+_Want:_ We can allow an event that originates in a node for any delegate.
+
+_Why:_ We want to constrain CI to privileged developers for a repository.
+
+~~~scenario
+given a Radicle node, with CI configured with broker.yaml and adapter dummy.sh
+given a Git repository xyzzy in the Radicle node
+given a Git repository other in the Radicle node
+
+given file config.yaml from filter-anydelegate.yaml
+given file update-nodeid.sh
+when I run bash update-nodeid.sh xyzzy config.yaml
+
+when I run cibtool --db ci-broker.db trigger --repo xyzzy --commit HEAD
+when I run cibtool --db ci-broker.db trigger --repo other --commit HEAD --node z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV
+
+when I run ./env.sh cib --config config.yaml queued
+
+when I run cibtool --db ci-broker.db run list --json
+then stdout contains ""repo_name": "xyzzy""
+then stdout doesn't contain ""repo_name": "other""
+~~~
+
+~~~{#filter-anydelegate.yaml .file .json}
+db: ci-broker.db
+adapters:
+  default:
+    command: ./adapter.sh
+triggers:
+  - adapter: default
+    filters:
+      - !AnyDelegate
+~~~
+
+
 ## Filter predicate `Tag`
 
 _Want:_ We can allow an event that is about a specific tag.