analyticsCatalogAuthorizer
@Bean
Who sends what: steps aside when CoSec decides (CoSecCommandAuthorizer, its policies alone, this one then having no objection); otherwise the catalog's roles decide (AnalyticsCatalogAuthorizer).