[Workspace] Define and implement ACL for the saved objects within workspaces

[gaobinlong]

Is your feature request related to a problem? Please describe.

This issue describes the definition and implementation of the ACL for the saved objects within workspaces.

According to the access control design proposal for saved objects in workspaces, each workspace object will be attached to an ACL, and the saved objects in that workspace will inherited the ACL by default. A saved object can be potentially in multiple workspaces, thus it inherits the ACL from all the workspaces it is assigned to. In most cases, the saved objects in a workspace will not be attached to an ACL, except it's shared with multiple workspaces or it's a global level advanced settings and can only be updated by the super admin of OSD.

Describe the solution you'd like

1. Workspace attached ACL

The following field permissions will be added to the document of the workspace object in OSD index(.kibana)

{
  "permissions": {
    "library_read": {
        "users": ["<user_1>", "<user_2>"],
        "groups":["<group_1>", "<group_2>"]
   },
    "library_write": {
        "users": ["<user_1>", "<user_2>"],
        "groups":["<group_1>", "<group_2>"]
   }
  } 
}

Permission modes:

• library_read: only can view the saved objects in the workspace
• library_write: can view and create/update/delete saved objects in the workspace

- **management**: can view and create/update/delete saved objects in the workspace, and also can view and update the feature set , settings, ACL of the workspace

Principal types:

• users: single user list, can use wildcard * to indicate all users
• groups: user group, can use wildcard * to indicate all groups

2. Ordinary saved object attached ACL

The following field permissions will be added to the document of the ordinary saved object in OSD index(.kibana)

{
  "permissions": {
    "read": {
        "users": ["<user_1>", "<user_2>"],
        "groups":["<group_1>", "<group_2>"]
   },
    "write": {
        "users": ["<user_1>", "<user_2>"],
        "groups":["<group_1>", "<group_2>"]
   }
  } 
}

Permission types:

• read: only can view the saved object
• write: can view, update, delete the saved object, and can also update the ACL of the saved object

Principal types:

• users: single user list, can use wildcard * to indicate all users
• groups: user group, can use wildcard * to indicate all groups

3. ACL related functions

Here are some encapsulated functions which can be used by SavedObjectClientWrapper.

• boolean hasPermission(permissionTypes: string[], principals: Principals): check whether the specific principal has the specific permission types or not
• addPermission(permissionTypes: string[], principals: Principals) : permissions object build function, add principal with specific permission to the object
• removePermission(permissionTypes: string[], principals: Principals): permissions object build function, remove specific permission of specific principal from the object
• toFlatList(): transform permissions format from permissionType->principals to principal->permissionTypes
• generateGetPermittedSavedObjectsQueryDSL( permissionTypes: string[], principals: Principals) : generate query DSL by the specific conditions, used for fetching saved objects from the saved objects index

Additional context

• [Feature][META]Workspace: [Feature][META]Workspace #4944