[BUG] DNFOF does not work for some APIs

[derek-ho]

What is the bug?
Some APIs which DNFOF should work for do not. Namely:
GET _cat/aliases

A similar issue was fixed for cat/indices here: #3236. It seems like the initial issue also called out aliases as a bug, but that was not addressed: #1815

How can one reproduce the bug?
Create a user without access to some of the following list, would expect DNFOF setting to work, but it does not

What is the expected behavior?
DNFOF should work

What is your host/environment?

• OS: [e.g. iOS]
• Version [e.g. 22]
• Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
Add any other context about the problem.

[stephen-crawford]

[Triage] Hi @derek-ho, thank you for filing this issue. This seems like a good addition based on the past discussion.