Strengthen system index protection in the plugin ecosystem

[cwperks]

Description

This PR strengthens system index protection by requiring that the plugin that stashed (switched) the threadcontext has registered the corresponding concrete system indices from the request if the transport request is an operation that affects system indices.

Corresponding PR in core: opensearch-project/OpenSearch#14630

The corresponding PR in core creates a notion of a PluginAwareNodeClient that is passed to plugins in createComponents. This class has a method called switchContext which is provided to plugins to switch out of the authenticated user context and into a "plugin" context. Effectively, this method behaves the same as stashContext by nullifying threadcontext headers, but it also populates a header called _plugin_execution_context that is populated by the canonical class name for the plugin that has switched contexts.

Inside the SecurityFilter, a new block is added in the section where authz is currently bypassed for plugins that have stashed the context. In this block, if the _plugin_execution_context is populated it will then check if the request is an index operation (contains indices) and if the concrete indices from the request overlap with the registered system index patterns of the plugin.

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Enhancement

Issues Resolved

Related to #4439

Testing

Adds integration tests that demonstrate how plugin1 cannot meddle with plugin2's system indices

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwperks]

Closing for now.