Fix: Canvas socket auth

[w33ble]

Summary

Closes #23303 (@cqliu1 can you confirm this too?) confirmed

Fixes the way we capture the request info when configuring the socket and providing it to plugins via callWithRequest. Instead of exposing a route that returns the info, simply use the request object that comes back from server.inject.

Also adds a check in the elasticsearchClient handler exposed to plugins to ensure the session is still valid because using callWithRequest.

Note: the actual error message is a bit different, but this is how the failure is exposed to the user

[cqliu1]

LGTM! I confirmed that we don't get authorization errors on any of the functions that query elasticsearch while logged into a user, so this does indeed fix #23303.

Proof:

[kobelb]

This is definitely better than the previous situation. The one side-effect which we'll have to figure out is how this should work with auth providers which use short-lived tokens which need to be refreshed. When we run authenticate directly, or indirectly via server.inject there's potential for us to be using the refresh token to get a new access token, which should be returned to the end-user with the set-cookie header, which we end up ignoring. This currently impacts SAML, but more and more auth providers will be switching to using these tokens, and this will definitely become exacerbated at that point.

[kobelb]

Also, my LGTM is conditional on CI going green.

[w33ble]

@kobelb would you mind opening a new issue about refreshing tokens? It's certainly something we should figure out for GA.

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request

[w33ble]

6.x fe7c9ec