Add CAT support to SubjectDescriptor

[mlepage-google]

• SubjectDescriptor basic implementation was added in initial prototype (Initial ACL prototype implementation #10236)
• this task is to add CAT support
• CAT1/CAT2 need to be set

[mlepage-google]

Current approach will be to store CAT tags in type NodeId in the subject descriptor, since the upper bits have discriminating ranges we can use to tell what "type" of NodeId it is.

[emargolis]

Addressed by #12027 and #12689

[mlepage-google]

Still need to hook up the CATs from the session into the SubjectDescriptor.

PR #13003 provides a place to do this, but doesn't actually do this.

[mlepage-google]

This is done now.