Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337)

mesh_store_reader held pg_read_all_data, so every caller of mesh-store.query
and postgres_query could read every column the store holds: the signing key
nodes trust, sealed secrets, password hashes. The reader now holds no role;
each minute, on every database, its memberships are revoked and its grants
brought to what the consumer's contribution lists under readable, minus any
column or table whose name says it holds a secret. Before a statement runs,
the reader's own session is asked which secret columns it can read and the
statement is refused if any; a statement naming a known secret table is
refused before it is sent.

modules/postgres/cmd/postgres-provider/client_test.go

@@ -221,12 +221,18 @@ func TestTheReaderIsMadeAsTheAdminWithEveryAttributeOnce(t *testing.T) {
 			}
 		}
 	}
-	if creates != 1 || readerCalls != 2 {
+	// Each query is two statements as the reader: what it can read that is secret, then the caller's.
+	if creates != 1 || readerCalls != 4 {
 		t.Fatalf("made %d times, %d reader calls", creates, readerCalls)
 	}
-	if !has(ddl, `^GRANT pg_read_all_data TO "`+Reader+`"$`) || !has(ddl, `default_transaction_read_only = on`) {
+	if !has(ddl, `default_transaction_read_only = on`) {
 		t.Fatal(strings.Join(ddl, "\n"))
 	}
+	// novox/hq issue 337: the reader reads only what is declared, so it is never given the role that
+	// reads everything — and an install that gave it that role has it taken back.
+	if has(ddl, `GRANT pg_read_all_data`) || !has(ddl, `^REVOKE pg_read_all_data FROM "`+Reader+`"$`) {
+		t.Fatal("the reader is given, or keeps, pg_read_all_data:\n" + strings.Join(ddl, "\n"))
+	}
 }
 
 func TestWithoutTheReadersPasswordNothingRunsAsTheAdmin(t *testing.T) {