Adding "read ingest pipeline" cluster privilege

[BigPandaToo]

The new privilege will allow to run ingest tools with minimal
privilege to check whether a
pipeline exists, without being able to modify it.
This privilege also support simulate pipeline too since it is a readonly
operation.

Resolve #48028

[BigPandaToo]

@elasticmachine update branch

[BigPandaToo]

@elasticmachine update branch

[albertzaharovits]

@BigPandaToo the unit test class that I alluded to in our conv is PrivilegeTests. I think we should add a new test there for this new privilege.

[BigPandaToo]

@elasticmachine update branch

[albertzaharovits]

Looking good @BigPandaToo , what it still needs is a simple unit test in PrivilegeTests or ClusterPrivilegeTests.

[albertzaharovits]

LGTM

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[ywangd]

@BigPandaToo @albertzaharovits We have two issues (#56353, #55640) suggesting deprecating the manage_ingest_pipelines privilege to in favor of manage_pipeline. Though we have not done anything about it because of bwc concerns, I wonder whether we should name the new privilege as read_pipeline instead of read_ingest_pipelines to avoid introducing another potential deprecation concern?

[tvernum]

I agree with @ywangd - if we've agreed (and I think we have) that manage_pipeline is the correct management privilege, then read_pipeline is the better name for the read privilege, and we should fix it.

[BigPandaToo]

I plan to open a Refuctoring issue to depricate and change the action names for the following privileges form "admin" to "monitor" :
GRANT_API_KEY
READ_INGEST_PIPELINE
MONITOR_SNAPSHOT
READ_CCR
READ_ILM
READ_SLM

How about I do this privileges name change as part of this refuctoring?

[tvernum]

I think we should just handle this change by itself. We can do a quick rename before 7.11.0 is released so that it doesn't break anything.
If we wait, we'll need to go through the deprecation cycle.