Vault: hash each bus account it is handed into bus-accounts.<user>, once per generation, so the grants part can compose the user list without the controller

The controller still mints each covered account and hands it to the vault (ADR 0374); ADR 0547 clause 9 has the vault
write the bcrypt hash of what it holds into its own state, readable by the grants part, and say account-hashed. It
hashes on keep, at start every held account with no key of its generation, and again by hand (account_hash); a refused
write is owed and written at the next pass. secret_own says per bus account whether this generation's hash is written.

Issue: 1945

modules/mesh-vault/module.json

@@ -14,11 +14,18 @@
   "emits": [
     "provisioned",
     "rotated",
-    "secret-changed"
+    "secret-changed",
+    "account-hashed"
   ],
   "reads": [
     "mesh-controller.assignments"
   ],
+  "state": [
+    {
+      "name": "bus-accounts",
+      "history": 2
+    }
+  ],
   "receives": {
     "secret": "${dir:grants}/mesh.json"
   },
@@ -146,6 +153,7 @@
     "secret_verify",
     "secret_handed",
     "secret_own",
+    "account_hash",
     "secret_asks",
     "secret_vault_export",
     "provisioner_retirement",