Fix: plugin api route with security enabled (elastic#23334) (elastic#…

…23402)

Closes elastic#23266

This is more of a quick fix than the final solution. The issue was that Canvas tries to check the plugins API without checking to see if the user it logged in. As a result, instead of the plugins response, it gets the HTML from the login page and that causes an error to be thrown when attempting to parse the results.

For now, this PR just disables the auth requirement on the Canvas plugin API endpoint.

x-pack/plugins/canvas/server/routes/plugins.js

@@ -18,5 +18,8 @@ export function plugins(server) {
 
       reply(getPluginStream(type));
     },
+    config: {
+      auth: false,
+    },
   });
 }