Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)

The night's backup of the bus takes each stream through JetStream's snapshot
API, run by the nats module under its own account. The module holding
mesh-broker is composed that account: stream names and info, the snapshot
request, its flow-control acks, its own inbox — no write, which the writers
table checks. A bus module declaring anything else to say on the bus is
refused by module check rather than silently granted nothing. The genesis
user list is unchanged: the controller's grants are.

internal/inventory/busrecords.go

@@ -141,6 +141,9 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 	if _, reads := m.OwnSecrets["broker"]; !reads {
 		d.NoAccount = true
 	}
+	// The bus's own module — the one holding mesh-broker — copies the bus's streams for the night's
+	// backup, and its account is granted that and nothing else (novox/hq ADR 0235).
+	d.SnapshotsTheBus = m.ClaimsSeat(catalogue.BrokerSeat)
 	for _, c := range m.Claims {
 		// Every seat with a protocol, the mesh's own included. One that says only who does a job is
 		// not here and grants nothing, which is most of them.