mesh-reads: read a node's files and accounts as an account that holds no secret (hq ADR 0310, issue 418)

Reading a file, searching one, listing a directory, the owner and mode of each
component of a path and looking up an account went through the login shell's
execute as the operator's account, which sees the operator's keys and the
agent's credentials, and execute is not served on the control-node. This module
holds node-reads on every node, runs as mesh-reads (no login, no group beside
its own), refuses the node's secret places by name before any read (the
controller's list and the known credential files), withholds any line shaped
like a secret through mesh-sdk's outward rule, and bounds every answer.

modules/mesh-reads/module.json

@@ -0,0 +1,54 @@
+{
+  "module": "mesh-reads",
+  "version": "1",
+  "runs-as": "mesh-reads",
+  "claims": [
+    {
+      "name": "node-reads",
+      "scope": "node",
+      "serves": [
+        "stat",
+        "readlink",
+        "list",
+        "read",
+        "search",
+        "account"
+      ]
+    }
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-reads",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-reads",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-reads"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-reads",
+      "place": "."
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-reads",
+        "binary": "mesh-reads",
+        "loads": [
+          "mesh-reads"
+        ]
+      }
+    ]
+  }
+}