Add ability for Watcher's webhook actions to send additional header

[dakrone]

This commit builds on #92576 by adding the xpack.notification.webhook.host_token_pairs keystore setting to allow an additional token to be sent when Watcher performs a webhook request. This includes both the regular webhook action as well as the email action that uses an attachment parameter to a url (which internally uses a webhook to retrieve the attachment).

These settings can both by reloaded by updating the keystore and using the reload secure settings API.

• xpack.notification.webhook.host_token_pairs is a comma-separated list of <host>:<port>=<token> pairs for which the header should be sent. For example, if this contains localhost:1234=token1,aoeu.com:9182=token2 then the token will only be added to the headers for webhook requests to the localhost and aoeu.com hosts on the 1234 and 9182 ports with tokens token1 and token2 respectively.

Also added is a cluster setting (non-dynamic) — xpack.notification.webhook.additional_token_enabled that determines whether the token should be sent. It defaults to false.

[elasticsearchmachine]

Hi @dakrone, I've created a changelog YAML for you.

[dakrone]

@elasticmachine update branch

[jbaiera]

Draft looks perfectly fine so far

[jbaiera]

😄

[dakrone]

@elasticmachine update branch

[dakrone]

I tested this on Cloud with the following watch:

PUT _watcher/watch/test_watch
{
  "trigger" : {
    "schedule" : { "cron" : "0 0 0 1 * ? 2099" }
  },
  "input" : {
    "simple" : {}
  },
  "actions" : { 
    "my_webhook" : {
      "webhook" : {
        "method" : "GET",
        "scheme": "https",
        "host" : "cft-custom-es-8.es.us-west2.gcp.elastic-cloud.com",
        "port" : 443,
        "path" : "/_cluster/health",
        "auth" : {
          "basic" : {
            "username" : "elastic", 
            "password" : "********"
          }
        }
      }
    },
    "email_my_team" : {
      "email" : {
        "to" : "lee@elastic.co",
        "subject" : "watcher test",
        "body" : "here is the body",
        "attachments" : {
          "dashboard.pdf" : {
            "reporting" : {
              "url": "https://cft-custom-es-8.kb.us-west2.gcp.elastic-cloud.com:9243/<long-pdf-generating-reporting-url>",
              "auth" : {
                "basic" : {
                  "username" : "elastic", 
                  "password" : "********"
                }
              }
            }
          }
        }
      }
    }
  }
}

And it works great, so I will toggle this to a regular PR.

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)

[dakrone]

I pushed another commit that adds the static cluster setting xpack.notification.webhook.additional_token_enabled, which defaults to 'false'. The new token will only be sent if this setting is set to 'true'.

[jbaiera]

Changes look good to me!