Add security permissions for DSL query-executor actions (dsl/execute, dsl/validate)

[shreyanshdwivedi]

Background

The dsl-query-executor sandbox plugin in OpenSearch intercepts _search and _validate/query at the transport layer and re-dispatches them to new internal transport actions with new action names:

• indices:data/read/dsl/execute
• indices:data/read/dsl/validate

The security plugin's built-in permission groups (read, search, etc.) don't know these new action names. On a secured cluster, a user whose role permits vanilla _search / _validate/query may be denied once the request is re-dispatched to the DSL action, because no role or permission group grants the new action name.

Ask

• Decide whether these DSL action names should map to an existing permission (e.g. the same one as _search / _validate/query) or need new permission-group entries.
• Register indices:data/read/dsl/execute and indices:data/read/dsl/validate so users already permitted to run _search / _validate/query retain access when the DSL plugin intercepts those requests.

References

• Tracking issue on OpenSearch side: Register DSL query-executor action names with the Security plugin permissions OpenSearch#22933
• DSL Query Executor meta: [META] OpenSearch DSL Query Executor Plugin OpenSearch#20914