[Fleet] Implement UX improvements for granular Fleet privileges

[kpollich]

The UX team has provided some improvements around discoverability and usage of Fleet's new granular permissions model.

See Figma.
Reach out to @simosilvestri for implementation support.

Implementation

Fleet landing page

• Add a new dismissible Callout banner at the top of the page, along with a link to the documentation.
• The Callout banner should only be displayed to admin accounts.
• If a customer dismisses the Callout banner, it should not be shown again.

Fleet - (Apply to Agents, Agent policis and Settings tab)

• Implement a read-only state to help customers understand their Fleet privileges access status. This feature is only applicable to regular accounts. Show the tooltip on hover.
• Additionally, disable the actions that regular accounts cannot perform. Show the tooltip on hover.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[nchaulet]

The Callout banner should only be displayed to admin accounts

@simosilvestri What do we mean by admin accounts? someone with kibana_admin role? superuser role? ?Fleet.All` privileges ?

[jen-huang]

The Callout banner should only be displayed to admin accounts

@simosilvestri What do we mean by admin accounts? someone with kibana_admin role? superuser role? ?Fleet.All` privileges ?

IMO it means fleet.all privileges because that was the only account option prior to the work for granular privileges.

Btw this message shouldn't be shown if hideAnnouncements from uiSettings is enabled. Similar to what was done in #183102

[simosilvestri]

Hi @nchaulet, sorry, maybe calling it "Admin" is confusing. I meant whoever has the permission to change these privileges?

[nchaulet]

@simosilvestri for the read-only icon it's possible the user do not have access to the agent tab and (with readonly access to agent policies for example) and the policies tab looks like this, where the icon should be shown in that case? will it be better to have that read-only in the header maybe?

Same for the settings tab

[simosilvestri]

@nchaulet - New criteria:
Move the [Read only label and icon] to the top right corner of the main header.