Let the generic command verb only read, and keep keys and tokens at the terminal

Review found a chain through the command verb: set the operator's key to one
the caller holds, rotate secrets so they are sealed to it too, read the sealed
copies, open them. Whoever may call a verb includes agents (hq ADR 0266), so
command now runs an allow list of reading forms, and operator, identity,
token, broker, api, licence and every secret command but rotate are refused
through any verb.

cmd/mesh-controller/agent_account_test.go

@@ -170,7 +170,7 @@ func TestNoVerbSetsANodesAccounts(t *testing.T) {
 		"node frobnicate",
 	} {
 		argv, err := argvFor("command", map[string]any{"command": line})
-		if err == nil || !strings.Contains(err.Error(), "controller's terminal only") ||
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") ||
 			!strings.Contains(err.Error(), "ADR 0266") {
 			t.Errorf("%q ran as %v (%v); want a refusal naming the terminal", line, argv, err)
 		}