Authorization check for extension REST Request

[cwperks]

Plugins currently permit users to perform actions registered by the plugin via roles. Below is an example of roles added for Anomaly Detection:

# Allow users to read Anomaly Detection detectors and results
anomaly_read_access:
  reserved: true
  cluster_permissions:
    - 'cluster:admin/opendistro/ad/detector/info'
    - 'cluster:admin/opendistro/ad/detector/search'
    - 'cluster:admin/opendistro/ad/detectors/get'
    - 'cluster:admin/opendistro/ad/result/search'
    - 'cluster:admin/opendistro/ad/tasks/search'
    - 'cluster:admin/opendistro/ad/detector/validate'
    - 'cluster:admin/opendistro/ad/result/topAnomalies'

# Allows users to use all Anomaly Detection functionality
anomaly_full_access:
  reserved: true
  cluster_permissions:
    - 'cluster_monitor'
    - 'cluster:admin/opendistro/ad/*'
  index_permissions:
    - index_patterns:
        - '*'
      allowed_actions:
        - 'indices_monitor'
        - 'indices:admin/aliases/get'
        - 'indices:admin/mappings/get'

For extensions, the actions also need to be permitted but the authorization cannot be performed on the Transport layer because the REST request is forwarded to the extension without ever hitting the transport layer.

Authorization needs to be built into the REST layer for requests destined for extensions (or other requests too?) to block the request before it is forwarded.

Extension REST handlers need a mapping to a string that identifies the action that can be permitted.

[davidlago]

#2590 supersedes this effort.