Re-pin the release sdk; the nats tools' credential gets a directory of its own the tools can reach (issue 1952)

modules/nats/module.json

@@ -20,7 +20,7 @@
   "bus-users": "/var/lib/nats-module/conf/accounts.conf",
   "own-secrets": {
     "broker": "${dir:mesh-state}/broker",
-    "broker-nats-tools": "${dir:mesh-state}/broker-nats-tools"
+    "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"
   },
   "capabilities": [
     "container-runtime"
@@ -92,6 +92,13 @@
       "mode": "0700",
       "unknown": "program"
     },
+    {
+      "id": "tools-secret",
+      "type": "directory",
+      "mode": "0711",
+      "place": "mesh",
+      "unknown": "program"
+    },
     {
       "id": "snapshots",
       "type": "directory",
@@ -202,7 +209,7 @@
           "MESH_NATS_CONTAINER": "mesh-broker-nats",
           "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
           "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
-          "NATS_TOOLS_CREDENTIAL": "${dir:mesh-state}/broker-nats-tools"
+          "NATS_TOOLS_CREDENTIAL": "${dir:tools-secret}/broker-nats-tools"
         }
       },
       {