api: fix update_repo check for permission to create top level repos The hg.create.repository permission only apply to creation (or renaming) of top level repos - it is not relevant for other kinds of renaming. Moving or renaming repos in other locations is now covered by other checks.