[Detection Engine] Add basic serverless rbac tests for detection engine

[yctercero]

Summary

Adding FTR RBAC tests for serverless prebuilt roles.

Following Serverless Security Roles spreadsheet.

Needs clarification

The following tests returned unexpected results and need confirmation of what the intended behavior should be. @approksiu @caitlinbetz

Actions

Our serverless spreadsheet denotes the following should be READ on actions, but:

• endpoint_operations_analyst requires feature_actions.all to manage endpoint actions and can't differentiate between endpoint/rule actions, so will have all. Also requires feature_siem.all to manage rules, so will also inherit being able to update rule actions.
• endpoint_policy_manager requires feature_actions.all to manage endpoint actions and can't differentiate between endpoint/rule actions, so will have all. Also requires feature_siem.all to manage rules, so will also inherit being able to update rule actions.
• rule_author requires feature_actions.all to manage endpoint actions and can't differentiate between endpoint/rule actions, so will have all. Also requires feature_siem.all to manage rules, so will also inherit being able to update rule actions.
• threat_intelligence_analyst requires feature_actions.all to manage endpoint actions and can't differentiate between endpoint/rule actions, so will have all. Also requires feature_siem.all to manage rules, so will also inherit being able to update rule actions.
• t3_analyst requires feature_siem.all to manage rules, so will also inherit being able to update rule actions.

Rule exceptions

Beta Give feedback

1. Endpoint Operations Analyst - should they be allowed to add an exception to a rule? Currently able to.
2. T1 Analyst - should they be allowed to add an exception to a rule? Currently able to.
3. T2 Analyst - should they be allowed to add an exception to a rule? Currently able to.
4. Viewer - should they be allowed to add an exception to a rule? Currently able to.

[kibanamachine]

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7260

[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/authentication/alerts/trial_license_complete_tier/configs/serverless.config.ts: 0/25 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/authentication/exceptions/trial_license_complete_tier/configs/serverless.config.ts: 24/25 tests passed.

see run history

[yctercero]

/ci

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 0db050b

Metrics [docs]

✅ unchanged

History

• 💛 Build #246157 was flaky 63cdc0d
• 💚 Build #246156 succeeded 63cdc0d

cc @yctercero