swarm-nats-auth: a review classifier hears try-outs and answers by reply only

swarm-queue-client gains review_classifier: the try-out subject, the
request and reply that travel on it, and the deadlines both ends share.
The controller's reader grant may publish the subject; a client named
with --review-classifier-client may subscribe to it and its inbox, and
answers under NATS allow_responses (resp in the user JWT) within the
run deadline. Every other client id is still denied.

swarm-nats-auth/src/xkey.rs

@@ -246,6 +246,7 @@ pub(crate) mod tests {
         let permissions = crate::policy::Permissions {
             publish: vec!["$KV.hive-status.alpha".to_owned()],
             subscribe: None,
+            responses: None,
         };
         let token = crate::respond::grant(
             &issuer,