test(service-analytics): pin the field-level read gate at the analytics door (#20917)

Every member an analytics query names, judged against the caller's
field-level read permissions before either strategy runs, answering the
engine's own refusal: the cube read and the SQL echo over the inferred and
an authored cube, and the dataset door, on both strategies, with the real
SecurityPlugin, ObjectQL and SqlDriver; plus the service-level gate and the
plugin's bridge to the security service. A readable member is the control.

Committed ahead of the change that satisfies them.

Claude-Session: https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude