edge.sh access: update reusable policies at the account endpoint; keep the minted secret on a redirected failure

[margani]

Fixes the two edge.sh access bugs from #85, found on nabz's first production run.

What changed

• Reusable policies: edge.sh reads reusable from the app's policy list. A reusable policy is updated at PUT /accounts/{account}/access/policies/{id}, because Cloudflare refuses the app endpoint for it with error 12130. A legacy policy is still updated at the app endpoint. Creating a policy is unchanged.
• Minted secret kept on failure: stdout is saved as fd 3 when the script starts, and on_exit prints the minted secrets to fd 3. Before, a die inside cf PUT … >/dev/null ran the EXIT trap with that redirection still active, so the secret it said it was printing went into /dev/null.
• Stub: a policy marked reusable is refused at the app endpoint with 12130 and updated at the account endpoint, as Cloudflare does. A policy whose name contains fail fails its update, to simulate a failure after a token has been minted.

Verification

./run-tests:

edge/tests/access_test.sh                    ok
...
all 10 passed, 3 skipped

(The skipped ones are harden_test.sh, which only runs on a disposable machine, and the two Windows-only .ps1 suites.)

The new cases fail on main's edge.sh:

== a reusable policy is updated where Cloudflare allows it ==
FAIL: a run against a reusable policy failed

Mutation test: with only the >&3 change reverted, the redirected-failure case fails:

== a failure inside a redirected call still prints the minted secret ==
FAIL: the secret minted before the failed policy update did not reach the caller:

Not verified

The fix hasn't been run against the real Cloudflare API yet. The first real call will be nabz's production infra-access, once nabz pins the release that contains this change.

Closes #85