Fix user privileges

[swallez]

Follow-up to PR #1963

IndicesPrivileges can contain multiple queries only in the context of GetUserPrivilegeResponses, and not in the context of RoleDescriptor. We therefore have to introduce a new UserIndicesPrivileges type that has multiple queries.

Additionally, this PR adds missing @codegen_names on RoleTemplateInlineScript.source, requiring to move it to a separate type to hold this annotation.

Finally, FieldSecurity.grant is actually optional.

[github-actions]

Following you can find the validation results for the APIs you have changed.

API	Status	Request	Response
security.activate_user_profile	🟢	8/8	8/8
security.authenticate	🟢	19/19	19/19
security.bulk_update_api_keys	🟠	Missing type	Missing type
security.change_password	🟢	6/6	6/6
security.clear_api_key_cache	🟢	12/12	12/12
security.clear_cached_privileges	🟢	3/3	3/3
security.clear_cached_realms	🟢	1/1	1/1
security.clear_cached_roles	🟢	2/2	2/2
security.clear_cached_service_tokens	🟢	4/4	4/4
security.create_api_key	🟢	41/41	32/32
security.create_service_token	🟢	3/3	3/3
security.delete_privileges	🟢	6/6	6/6
security.delete_role_mapping	🟢	9/9	9/9
security.delete_role	🟢	8/8	8/8
security.delete_service_token	⚪	Missing test	Missing test
security.delete_user	🟢	9/9	9/9
security.disable_user_profile	🟢	1/1	1/1
security.disable_user	🟢	3/3	3/3
security.enable_user_profile	🟢	1/1	1/1
security.enable_user	🟢	4/4	4/4
security.enroll_kibana	⚪	Missing test	Missing test
security.enroll_node	⚪	Missing test	Missing test
security.get_api_key	🟢	28/28	28/28
security.get_builtin_privileges	🟢	2/2	2/2
security.get_privileges	🟢	12/12	12/12
security.get_role_mapping	🟢	18/18	18/18
security.get_role	🟢	20/20	20/20
security.get_service_accounts	⚪	Missing test	Missing test
security.get_service_credentials	🟢	1/1	1/1
security.get_token	🟢	23/23	22/22
security.get_user_privileges	🟢	7/7	7/7
security.get_user_profile	🟢	8/8	8/8
security.get_user	🟢	25/25	25/25
security.grant_api_key	🟢	7/7	7/7
security.has_privileges_user_profile	🟢	3/3	3/3
security.has_privileges	🟢	21/21	21/21
security.invalidate_api_key	🟢	10/10	10/10
security.invalidate_token	🟢	11/11	11/11
security.oidc_authenticate	🟠	Missing type	Missing type
security.oidc_logout	🟠	Missing type	Missing type
security.oidc_prepare_authentication	🟠	Missing type	Missing type
security.put_privileges	🟢	10/10	10/10
security.put_role_mapping	🟢	11/11	11/11
security.put_role	🟢	35/35	34/34
security.put_user	🟢	43/43	42/42
security.query_api_keys	🟢	9/9	9/9
security.saml_authenticate	⚪	Missing test	Missing test
security.saml_complete_logout	⚪	Missing test	Missing test
security.saml_invalidate	⚪	Missing test	Missing test
security.saml_logout	⚪	Missing test	Missing test
security.saml_prepare_authentication	⚪	Missing test	Missing test
security.saml_service_provider_metadata	⚪	Missing test	Missing test
security.suggest_user_profiles	🟢	1/1	1/1
security.update_api_key	🟢	4/4	4/4
security.update_user_profile_data	🟢	1/1	1/1

You can validate these APIs yourself by using the make validate target.

[github-actions]

The backport to 7.17 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-7.17 7.17
# Navigate to the new working tree
cd .worktrees/backport-7.17
# Create a new branch
git switch --create backport-1966-to-7.17
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick --mainline 1 308b92158eeb3a64ad290f6832221dcc56d8d69a
# Push it to GitHub
git push --set-upstream origin backport-1966-to-7.17
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-7.17

Then, create a pull request where the base branch is 7.17 and the compare/head branch is backport-1966-to-7.17.