[8.0] Remove support for configuring csp.rules

[TinaHeiligers]

Related to #103915

Removes support for csp.rules

CSP misconfiguration is a regular cause of frustration for users and support tickets and to help alleviate the issue, we implemented additive configuration. Configuring csp.rules was deprecated at the same time with a warning that support for the configuration would be removed in 8.0.

This PR removes support for configuring csp.rules and as a consequence.
As a consequence, this PR also handles the conditional config deprecation on specific rules (can't include nonce, must include self introduced in 7.4)

Note: The underlying implementation remains the same in that we combine the default Kibana rules with specific, per-directive configurations to compose the http request header.

Checklist

• Documentation was added for features that require explanation or tutorials
• Document change in breaking changes
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be added to/removed from the docker list
• This was checked for cross-browser compatibility (Firefox, Chrome, Safari only)
  If a plugin configuration key changed, check if it needs to be allowlisted in the cloud
• allowlist

For maintainers

• This was checked for breaking API changes and was labeled appropriately

Release Note

Support for the csp.rules configuration property has been removed in favor of directive specific configuration. Configuring the default csp.script_src, csp.workers_src and csp.style_src values is not required.

[TinaHeiligers]

@elasticmachine merge upstream

[jbudz]

kibana-docker LGTM

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[TinaHeiligers]

@elasticmachine merge upstream

[jportner]

LGTM, found a couple of tiny nits in the comments below. Also one more in the dev docs but GitHub won't let me add comments on unchanged sections. Suggested change:

diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 6d086de63c3..88d8b7f9da5 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -495,8 +495,8 @@ To disable, set to `null`. *Default:* `null`
 | Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy[`Content-Security-Policy`] and
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options[`X-Frame-Options`] headers are configured to disable embedding
 {kib} in other webpages using iframes. When set to `true`, secure headers are used to disable embedding, which adds the `frame-ancestors:
-'self'` directive to the `Content-Security-Policy` response header (if you are using the default CSP rules), and adds the `X-Frame-Options:
-SAMEORIGIN` response header. *Default:* `false`
+'self'` directive to the `Content-Security-Policy` response header and adds the `X-Frame-Options: SAMEORIGIN` response header. *Default:*
+`false`
 
 | `server.customResponseHeaders:` {ess-icon}
  | Header names and values to

[jportner]

This class was the only consumer of CspDirectives.getRules(). I don't suppose we ever actually needed to expose the individual rules anyway, we really just needed to expose the CSP header.

Nit: Since you've removed this usage here, you could remove that method from the CspDirectives class (or just make it private) and remove those assertions from its unit tests, too.

[TinaHeiligers]

True, there's no need to keep getRules since we are only using it within the CspDirectives class. I've removed it (inlining directly in getCspHeader) and updated the tests.

[TinaHeiligers]

@elasticmachine merge upstream

[tylersmalley]

@elasticmachine merge upstream

[TinaHeiligers]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 6c86115
• Storybooks Preview
• Documentation Changes

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
core	1019	1018	-1

Unknown metric groups

API count

id	before	after	diff
core	2300	2298	-2

History

• 💔 Build #159734 failed 96905c6
• 💔 Build #159705 failed cdc7904
• 💔 Build #159677 failed 7fc86a4
• 💚 Build #159293 succeeded f81e36d
• 💚 Build #159202 succeeded d2fb5a6

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream