AZ624: The app role is the policy's owner

The app role is the role the rules apply to, so it must be a role of its own. Here it is the role that applies the policy, or a member of it. That role skips row-level security as the tables' owner and may turn it off, it may read rowstile's tables (the key that signs sessions among them), and who is signed in is believed without a signature in its sessions: the rules would not hold for it. Make a role for the app (CREATE ROLE app_user LOGIN), grant it what the app needs on the tables, name it in the policy (app role app_user), and apply as the tables' owner. authz.lint() reports an app role that became a member of the owner since, and authz.connection_check() a connection that logs in as one.

Reported when the policy is applied (rowstile push, apply, a migration), against the database.