As of now the validation occurs at runtime when the query is being
executed. I think the reason was due to the use of template queries
which need runtime information as they need to be evaluated like
user information.

This commit adds validation for the role query but **not for the
template query** as we do not have the runtime information required
for evaluating the template query.
This also corrects some tests and roles.yml files where the `query` field was not
populated correctly.
For validation, the query is evaluated (if not a template), parsed to build the
`QueryBuilder` and verify if the query type is allowed.

Closes elastic#34252

- add index privileg index to the error message to denote query of which
index privilege failed to validate.
- add more information to the error message where we know the expected values

- public to package protected method
- return immediately for simpler methods
- correct the logic in file roles and add tests

… DLS query