[2.9] Add workflow cluster permissions to alerting roles and add .plugins-ml-config in the system index

[cwperks]

Description

Creating manual backport of #2994 and #2993 to 2.9 to ensure the changes are included in the RC build for 2.9

@opensearch-project/engineering-effectiveness These PRs came in late for code freeze, but should be included in the 2.9 RC build. Can these changes be included? These are low risk changes as they are config changes to update the cluster_permissions in reserved roles for alerting or to grant system index permission to an index in ML commons. @Zhangxunmt please confirm that testing was performed with .plugins-ml-config with security.

@davidlago Tagging you on this PR to keep you in the loop

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Enhancement

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

Merging #2996 (18021e5) into 2.9 (56e07dd) will decrease coverage by 0.08%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##                2.9    #2996      +/-   ##
============================================
- Coverage     62.27%   62.20%   -0.08%     
+ Complexity     3319     3307      -12     
============================================
  Files           264      264              
  Lines         19468    19468              
  Branches       3326     3326              
============================================
- Hits          12124    12110      -14     
- Misses         5720     5729       +9     
- Partials       1624     1629       +5     

see 9 files with indirect coverage changes

[stephen-crawford]

Thanks Craig.

[cwperks]

@eirsep @Zhangxunmt I created this backport directly into the 2.9 branch that includes #2993 and #2994. Confirming with @opensearch-project/engineering-effectiveness if these changes can be included in the RC build.

[Zhangxunmt]

Thanks @cwperks ! Please merge ASAP once all CI passed.