How do these federated forges deal with spam? If merge requests and issues are federated, does that mean that anybody running a radicle node (or interacting with one) can open issues or merge requests on all the repositories that you've made public? Or is there a whitelist (or something fancier?) to allow interaction only with specified nodes?