[BUG]Currently /_plugins/_query/settings API can act as backdoor for any kind of cluster settings.

[vamsi-amazon]

What is the bug?
Currently /_plugins/_query/settings API can act as backdoor to change any kind of cluster settings.

• Validate if the above assumption is true.
• Restrict the above API to only settings required.

New Settings Introduced, we need to deny all the settings below.

• plugins.query.datasources.encryption.masterkey
• plugins.query.datasources.uri.hosts.denylist
• plugins.query.executionengine.spark.config
• plugins.query.executionengine.spark.session.limit
• plugins.query.executionengine.spark.refresh_job.limit
• plugins.query.executionengine.spark.session.index.ttl
• plugins.query.executionengine.spark.result.index.ttl
• plugins.query.executionengine.spark.auto_index_management.enabled