[Fleet][Endpoint][RBAC V2] Update fleet router and config to allow API access via RBAC controls

[ashokaditya]

Summary

Note
This PR is adding changes only to some of api/fleet/package_policies
API routes, there will be subsequent PRs after this to update
api/fleet/epm/packages, api/fleet/agent_policeis and,
api/fleet/agent_status.

This PR introduces the framework needed in fleet in order to be able to
support Package level Privileges - meaning: if a user does not have
authorization granted via Fleet and/or Integration privileges, then
package level privileges are check and API access granted. When access
is granted based on Package Privileges, the data is also validated to
ensure that it is limited to the integration package names that were
given authorization to the API.

The following APIs were updated to leverage this new framework:

• Integration Package Policy list API
• Integration Package Policy get one API
• Integration Package Policy update one API
• Integration Package Policy bulk get API

ℹ️ these API were updated in support of Endpoint use cases needed for
v8.7.

Example of API error for Package policies api:

{
    "statusCode": 403,
    "error": "Forbidden",
    "message": "Authorization denied to [package.name=fleet_server]. Allowed package.name's: endpoint"
}

---

To test:

1. Log in as elastic/superuser and create some agent policies.

2. Under Stack Management, create a role policy_role with the
   following RBAC settings. DO NOT select Fleet -> All or toggle
   Integrations. Leave those RBAC toggles set to None
   

3. Create a user e.g. policy_user and assign them only the above
   role. NOT superuser.

4. Login with this user and navigate to
   app/security/administration/policy or curl/postman.

5. Expect to see the following:

• GET api/fleet/epm/packages?category=security should return a 403
  status.
• GET
  api/fleet/package_policies?page=1&perPage=10&kuery=ingest-package-policies.package.name%3A%20endpoint
  should return a list of policies.
• GET /api/fleet/package_policies/<packagePolicyId> should return a
  200 and a signle item that has the policie's details. Note that the
  package name of this item is endpoint.
• there should be a POST API request matching
  api/fleet/agent_policies/_bulk_get, and should return a 403.

5. With Policy Management RBAC set to All

• PUT
  http://localhost:5601/api/fleet/package_policies/<packagePolicyId>
  should return a 200 with the updated policy details as response

Checklist

• Unit or functional
  tests
  were updated or added to match the most common scenarios

• This was checked for breaking API changes and was labeled
  appropriately

Co-authored-by: Paul Tavares paul.tavares@elastic.co