Support authenticating to Elasticsearch via service account tokens

[legrego]

Summary

Adds support for authenticating to Elasticsearch via service account tokens.

Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.

This PR adds a new elasticsearch.serviceAccountToken configuration option, which can be used in place of the traditional elasticsearch.username and elasticsearch.password configuration options.

Note I am marking this as beta in the docs because the underlying ES APIs are marked as beta. This gives us the necessary flexibility to make a breaking change if required (although I do not expect any at this time)

⚠️ Testing instructions

This PR must be tested against elastic/elasticsearch#73738, as this contains the code necessary to grant service account tokens with the necessary privileges for the kibana-system service account.

Once Elasticsearch is up and running, issue the following API call as the elastic user to generate a service account token:

POST /_security/service/elastic/kibana-system/credential/token/<some_token_name>

You will receive a token in the response. This token should be used in your kibana.yml:

# configuration via service account tokens
elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hLXN5c3RlbS9teS10b2tlbjpJNnNzbllPOFExRzBnR2pVQ0RCSGRB

Checklist

• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jbudz]

legrego helped me with getting this tested, in case it helps others:

1. clone es into a sibling directory of kibana
2. git fetch origin pull/73738/head:pr/73738
3. git checkout pr/73738
4. cd ../kibana && yarn es source --license trial

Few nits above but overall LGTM. I ran some extra tests with verbose logging to make sure none of this was leaked, didn't have any issues.

[legrego]

We decided today to wait until the 7.15 branch is cut before merging. We require changes in ES to land alongside this PR, and we don't wish to squeeze that into the 7.14.0 release at this time.

[legrego]

@elasticmachine merge upstream

[kibanamachine]

expected head sha didn’t match current head ref.

[legrego]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 9a80475
• Storybooks Preview
• Documentation Changes

Metrics [docs]

Unknown metric groups

API count

id	before	after	diff
core	2327	2328	+1

History

• 💚 Build #137731 succeeded 7704d92
• 💚 Build #131272 succeeded 4d188c9
• 💔 Build #131132 failed f17637d
• 💔 Build #131116 failed d7e86ba
• 💔 Build #131104 failed 05ae9bd

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @legrego

[kibanamachine]

💔 Backport failed

Status	Branch	Result
❌	7.x	Commit could not be cherrypicked due to conflicts

To backport manually run:
node scripts/backport --pr 102121

[legrego]

Manual backport to 7.x/7.15: #105286