Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337)

mesh_store_reader held pg_read_all_data, so every caller of mesh-store.query
and postgres_query could read every column the store holds: the signing key
nodes trust, sealed secrets, password hashes. The reader now holds no role;
each minute, on every database, its memberships are revoked and its grants
brought to what the consumer's contribution lists under readable, minus any
column or table whose name says it holds a secret. Before a statement runs,
the reader's own session is asked which secret columns it can read and the
statement is refused if any; a statement naming a known secret table is
refused before it is sent.

modules/postgres/cmd/postgres-provider/main.go

@@ -53,6 +53,9 @@ func main() {
 		go h.Run(context.Background())
 	}
 	go audit()
+	// The store's reader is narrowed to what modules declare readable, at once and every minute, whether
+	// or not the provisioner runs: without a contributions file it is given nothing (novox/hq issue 337).
+	go pg.RunReader(context.Background(), os.Getenv("MESH_RECEIVES"), time.Minute, say)
 	// The retirement tools beside postgres's own: what is retired here, approving or rejecting what waits
 	// for a person, and deleting a retired consumer (novox/hq ADR 0230).
 	if err := stdio.Serve("", append(Tools(pg), RetirementTools(h)...)); err != nil {