[Security Solutions] Fixes the permissions to require cluster.manage for upgrades of solutions

[FrankHassanabad]

Summary

Fixes error toaster on signals upgrades as well as creation of new signals if you have a user without a cluster manage privilege.

Simplest way to manually test both situations of a user on creating a new signal as well as upgrade is to first create a new role like so in dev tools:

PUT _security/role/reduced_permissions
{
   "indices":[
      {
         "names":[
            ".siem-signals-*",
            ".lists-*",
            ".items-*"
         ],
         "privileges":[
            "all"
         ],
         "field_security":{
            "grant":[
               "*"
            ]
         },
         "allow_restricted_indices":false
      }
   ],
   "applications":[
      {
         "application":"kibana-.kibana",
         "privileges":[
            "space_all"
         ],
         "resources":[
            "space:default"
         ]
      }
   ]
}

You might have to change this line above to match what your kibana.index is set to if it is set:

 "application" : "kibana-.kibana-hassanabad8",

Double check things in Stack Management to ensure you have access to at least default space:

Next add a user which has this role of reduced_permissions to login as that user. Next for testing that this causes an error toaster when there is no signals index is to either manually delete your signals index or change your kibana.dev.yml so that it thinks you have a new index:

xpack.securitySolution.signalsIndex: .siem-signals-some-new-index-name

Start up Kibana, login with the new user and visit any page and notice you get an error toaster like below:

And also notice that you are blocked from viewing signals at this point:

For upgrading signals manually, you can change the version number from dev tools or increment the number directly within this file and restart Kibana:
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts#L10

When you visit the detection page you will see the same error toaster and also be blocked. With this PR you will no longer be blocked.

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[spong]

LGTM! Code check now matches permissions outlined in docs. If you have a chance to add a test that would be greatly appreciated! @dhurley14 has made some helpers (#81866) so should be pretty straight forward. Thanks @FrankHassanabad! 💎 🙌 🚀

[FrankHassanabad]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: df0fe88

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	7.5MB	7.5MB	+26.0B

History

• 💔 Build #102811 failed f0e491e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream