[Saved Objects] Allow saved object owners to set encrypted fields during creation without a fake request

[TinaHeiligers]

The savedObjectsRepository does not currently support field encryption when creating saved objects using a scoped client

The workaround, using a fakeRequest, is the only alternative, for example:

kibana/x-pack/platform/plugins/shared/fleet/server/services/agent_policy_watch.ts

Lines 49 to 59 in 092c2cd

	private makeInternalSOClient(soStart: SavedObjectsServiceStart): SavedObjectsClientContract {
	const fakeRequest = {
	headers: {},
	getBasePath: () => '',
	path: '/',
	route: { settings: {} },
	url: { href: {} },
	raw: { req: { url: '/' } },
	} as unknown as KibanaRequest;
	return soStart.getScopedClient(fakeRequest, { excludedExtensions: [SECURITY_EXTENSION_ID] });
	}

kibana/x-pack/solutions/security/plugins/security_solution/server/endpoint/lib/policy/license_watch.ts

Lines 56 to 66 in 092c2cd

	private makeInternalSOClient(soStart: SavedObjectsServiceStart): SavedObjectsClientContract {
	const fakeRequest = {
	headers: {},
	getBasePath: () => '',
	path: '/',
	route: { settings: {} },
	url: { href: {} },
	raw: { req: { url: '/' } },
	} as unknown as KibanaRequest;
	return soStart.getScopedClient(fakeRequest, { excludedExtensions: [SECURITY_EXTENSION_ID] });
	}

kibana/x-pack/solutions/security/plugins/security_solution/server/endpoint/lib/policy/telemetry_watch.ts

Lines 52 to 62 in 092c2cd

	private makeInternalSOClient(soStart: SavedObjectsServiceStart): SavedObjectsClientContract {
	const fakeRequest = {
	headers: {},
	getBasePath: () => '',
	path: '/',
	route: { settings: {} },
	url: { href: {} },
	raw: { req: { url: '/' } },
	} as unknown as KibanaRequest;
	return soStart.getScopedClient(fakeRequest, { excludedExtensions: [SECURITY_EXTENSION_ID] });
	}

Ideally, there should be a way for a third party to access the SO service's extensions to pass in (currently private without accessors).

Alternatives:

• A soStart.getInternalClient function to the start contract
• A way to instantiate an SOR using the SO service's extensions by default. e.g.
  savedObjects.createInternalRepository({ withExtensions: true }) or
  savedObjects.createInternalRepository({ withExtensions: ['encryptedSavedObjects'] })

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)