[EDR Workflows] Workflow Insights - RBAC

[szwarckonrad]

Access Control for Endpoint Workflow Insights

This PR adds access control to the Endpoint Workflow Insights functionality. Both the UI and API are gated based on the following conditions. If these conditions are not met, the content will not render, and direct API calls will return errors.

Access Conditions

1. Serverless: Requires the Endpoint Complete Tier.
2. ESS: Requires an Enterprise License.
3. User Privileges:
    3.1 Endpoint Insights Privilege must be enabled:
        3.1.1 Endpoint Insights All: Grants full access.
	3.1.2 Endpoint Insights Read:
	    3.1.2.1 Allows users to view generated insights but prevents triggering new scans.
	    3.1.2.2 With Trusted Applications privilege: Users can remediate already generated insights.
	    3.1.2.3 Without Trusted Applications privilege: No actions can be taken.
	3.1.3Endpoint Insights None: The section is not rendered.

Predefined serverless roles that should include endpoint insights privilege(as defined here):

• Tier 3 analyst
• Rule Author
• SOC Manager
• Endpoint Operations Analyst
• Endpoint Policy Manager
• Platform Engineer

Once this PR is merged and changes make it to canary release, this follow-up PR should be merged.

Note on Testing and Local Setup

To test these changes locally, the defendInsights assistant feature must be enabled. You can do this by updating the following line in the code: Enable defendInsights here.

Cypress Tests

Cypress tests in this PR are currently skipped because the defendInsights feature is not enabled by default. These tests should be enabled once the feature is turned on in the main branch. Successful run with all cypress tests enabled can be found here.

Screenshots

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a37b644

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	21.4MB	21.4MB	+4.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
fleet	174.2KB	174.4KB	+242.0B
securitySolutionServerless	26.4KB	26.4KB	+85.0B
total			+327.0B

History

• 💛 Build #262774 was flaky b38f206
• 💔 Build #262767 failed 5297d88

[jbudz]

Changes to packages/kbn-es/src/serverless_resources/project_roles/security/roles.yml LGTM

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[juliaElastic]

Fleet change LGTM