nats: the tools run on the process account nats-tools with its own secret, and take the release sdk, so the bus grants them only the four removals (issue 1952 N1-N3)

modules/nats/module.json

@@ -19,7 +19,8 @@
   ],
   "bus-users": "/var/lib/nats-module/conf/accounts.conf",
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "${dir:mesh-state}/broker",
+    "broker-nats-tools": "${dir:mesh-state}/broker-nats-tools"
   },
   "capabilities": [
     "container-runtime"
@@ -200,7 +201,7 @@
           "MESH_NATS_CONTAINER": "mesh-broker-nats",
           "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
           "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
-          "MESH_BROKER_FILE": "${dir:mesh-state}/broker"
+          "MESH_BROKER_FILE": "${dir:mesh-state}/broker-nats-tools"
         }
       },
       {