Add documentation for on-behalf-of token authorization

[cwillum]

Description

On-behalf-of tokens will allow users to authorize services running with OpenSearch on their behalf. The first use case for this token is the Security extension.

Issues Resolved

Fixes #4388

Checklist

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
  For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwillum]

Pausing this for 2.9. If it doesn't get fresh attention between release cycles, it will be an issue for 2.10.

[cwillum]

Pushed to 2.10.

[cwillum]

@RyanL1997 I'm getting near to completing a rough draft for OBO authentication. A few questions remain:

• Has anything changed in configuration/usage since the documentation issue [DOC] Add documentation for OnBehalfOf Authentication #4388 was created?
• You can see I've created some questions in comments (inline with text in "Files changed"). Basically they have to do with authc configuration in the config.yml file (see changes). The JWT auth domain doesn't appear to require an encryption_key setting in its configuration. Is there a special use here for OBO? Are there additional configuration settings for OBO that carry over from a JWT domain configuration (e.g., challenge to false, the jwt_header, set authentication_backend type to noop)?
• I'm not quite clear on the "Roles in OBO's Payload" section in the documentation issue. What is this about? Where is this configured? Is there more information somewhere about the part this plays in OBO and how it's used?

Thanks.