[Feature/Extension] Restrict OBO token's usage for certain endpoints

[RyanL1997]

Description

Edge Cases Of OBO Token Usage:

• User should not use OBO Token to issue another OBO Token
• User should not use OBO Token to modify users' authinfo, such as resetting password

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)
  New feature

Issues Resolved

• Resolve [FEATURE] Handle the edge cases of On-behalf-of Authentication #2891

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[RyanL1997]

This branch should sync with main after the merge of #3003

[cwperks]

Thank you Ryan! I took a first pass and left a few comments around structure.

[cwperks]

IMO OBO should be lower cased here.

[RyanL1997]

Done~

[peternied]

I'm struggling to think what the correct criteria is for these restrictions, while the issue has called out the OBO tokens creation API, I think we should articulate the criteria for something to be acceptable vs not acceptable first. Lets try to build consensus around this idea first before implementing restrictions so we can be consistent.

What if instead of denying permissions to different APIs system, what if instead only let you create OBO tokens that expire at latest when the currently OBO token expires. This prevents the 'no expiration' in a more 'logical' way than the permissions denial.

[codecov]

Codecov Report

Merging #3008 (082874a) into feature/extensions (634e3af) will decrease coverage by 0.10%.
Report is 48 commits behind head on feature/extensions.
The diff coverage is 62.53%.

@@                   Coverage Diff                    @@
##             feature/extensions    #3008      +/-   ##
========================================================
- Coverage                 62.43%   62.34%   -0.10%     
- Complexity                 3353     3387      +34     
========================================================
  Files                       254      259       +5     
  Lines                     19741    20036     +295     
  Branches                   3334     3371      +37     
========================================================
+ Hits                      12326    12492     +166     
- Misses                     5785     5889     +104     
- Partials                   1630     1655      +25     

Files Changed	Coverage Δ
...earch/security/auditlog/impl/AbstractAuditLog.java	76.48% <ø> (ø)
...pensearch/security/auditlog/impl/AuditMessage.java	74.00% <ø> (ø)
...search/security/auditlog/impl/RequestResolver.java	67.75% <ø> (ø)
.../org/opensearch/security/auth/BackendRegistry.java	59.72% <0.00%> (-0.42%)	⬇️
...ava/org/opensearch/security/auth/UserInjector.java	90.00% <ø> (ø)
...ty/configuration/SecurityIndexSearcherWrapper.java	88.88% <ø> (ø)
...earch/security/dlic/rest/api/AccountApiAction.java	85.13% <ø> (ø)
.../security/dlic/rest/api/PermissionsInfoAction.java	19.56% <ø> (ø)
...dlic/rest/api/RestApiAdminPrivilegesEvaluator.java	71.42% <ø> (ø)
...rity/dlic/rest/api/RestApiPrivilegesEvaluator.java	69.07% <ø> (ø)
... and 28 more

... and 3 files with indirect coverage changes