Convert security solution -> cases sub feature to a top-level feature

[legrego]

Currently, the security solution "cases" feature is a sub-feature privilege.

We would like to convert this to become a top-level feature in the 8.0 release, since this is a breaking change. This will allow us to align the Cases features for Observability and Security Solution, and allow for cases to take advantage of sub-feature privileges themselves in the future.

Tasks:

• Create new top-level Cases feature under the Security category
• Create an Upgrade Assistant automated fix to rewrite roles that are granting access to the Cases sub-feature to use the new top-level Cases feature

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[XavierM]

@jportner and @watson, if you both do not mind it, I can take this one and you can review it. what do you think?

[jportner]

@jportner and @watson, if you both do not mind it, I can take this one and you can review it. what do you think?

That would be great, thanks!

As mentioned in the linked meta issue (#111160), we need to do separate things for 7.x and master:

• 7.x branch: Ensure that the 8.0 upgrade assistant accurately reflects all of the deprecations

  • Each deprecation should be set at the appropriate level (critical if it blocks the upgrade, warning if not)
  • Each deprecation should correctly describe when the breaking change will take effect (8.0, or a future version)
  • The copy (text) should be reviewed with the docs team
  • Any automation to fix the problem (correctiveActions.api registered in the DeprecationsService) should be implemented and tested

• master branch: Ensure that, for breaking changes that take effect in 8.0, all appropriate code is removed

We discussed this particular issue with Platform leadership, and decided that the upgrade assistant in 7.x should provide an automated remediation to "fix" existing roles that are impacted.

Here's how I think we should approach that:

Each role with Custom Privileges that grants the Cases sub-feature privilege should surface as a separate warning in the Upgrade Assistant. Each warning should provide a button to automatically fix the problem (via correctiveActions.api). This should call PUT /api/security/role/{name} to update the role. The updated role should grant both the existing sub-feature privilege and the new feature privilege -- the latter will only have any effect when the user actually upgrades to 8.0.

Let me know if that makes sense or if you think it should be handled differently.
The actual deprecations should probably be added in the Security Solution plugin.

CC @legrego if you have any input.

[legrego]

Resolved via #112980