[Backport 2.x] Service accounts and on-behalf-of authentication in 2.x

[RyanL1997]

Implement on behalf of token passing for extensions

Description

This is a manual backport of feature Service Accounts and On-behalf-of Authentication for security plugin

Related Issues

• Relate Backport Service Account into 2.x branch security#3557

PRs

• Relate Implement on behalf of token passing for extensions #8679
• Relate Provide service accounts tokens to extensions #9618
• Relate Remove the authenticate token method from TokenManager and from the Subject interface #10614
• Relate OnBehalfOf claims take second duration #10664

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Failing checks are inspected and point to the corresponding known issue(s) (See: Troubleshooting Failing Builds)
• Commits are signed per the DCO using --signoff
• Commit changes are listed out in CHANGELOG.md file (See: Changelog)
• Public documentation issue/PR created

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/29446/
• CommitID: 1607aae
  Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
  Is the failure a flaky test unrelated to your change?

[github-actions]

Compatibility status:

Checks if related components are compatible with change 64504cb

Incompatible components

Incompatible components: [https://github.com/opensearch-project/performance-analyzer.git]

Skipped components

Compatible components

Compatible components: [https://github.com/opensearch-project/security.git, https://github.com/opensearch-project/alerting.git, https://github.com/opensearch-project/index-management.git, https://github.com/opensearch-project/anomaly-detection.git, https://github.com/opensearch-project/asynchronous-search.git, https://github.com/opensearch-project/sql.git, https://github.com/opensearch-project/common-utils.git, https://github.com/opensearch-project/observability.git, https://github.com/opensearch-project/job-scheduler.git, https://github.com/opensearch-project/reporting.git, https://github.com/opensearch-project/security-analytics.git, https://github.com/opensearch-project/cross-cluster-replication.git, https://github.com/opensearch-project/k-nn.git, https://github.com/opensearch-project/custom-codecs.git, https://github.com/opensearch-project/geospatial.git, https://github.com/opensearch-project/ml-commons.git, https://github.com/opensearch-project/performance-analyzer-rca.git, https://github.com/opensearch-project/notifications.git, https://github.com/opensearch-project/neural-search.git]

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: SUCCESS ✅
• URL: https://build.ci.opensearch.org/job/gradle-check/29448/
• CommitID: f55f2a8

[codecov]

Codecov Report

Merging #11052 (64504cb) into 2.x (e297b21) will increase coverage by 0.11%.
Report is 1 commits behind head on 2.x.
The diff coverage is 74.50%.

@@             Coverage Diff              @@
##                2.x   #11052      +/-   ##
============================================
+ Coverage     70.86%   70.97%   +0.11%     
- Complexity    58864    58876      +12     
============================================
  Files          4850     4851       +1     
  Lines        277900   277932      +32     
  Branches      40735    40736       +1     
============================================
+ Hits         196937   197272     +335     
+ Misses        64238    63881     -357     
- Partials      16725    16779      +54     

Files	Coverage Δ
...g/opensearch/identity/shiro/ShiroTokenManager.java	93.33% <100.00%> (+28.21%)	⬆️
...a/org/opensearch/extensions/ExtensionsManager.java	52.14% <100.00%> (+1.20%)	⬆️
...g/opensearch/extensions/NoopExtensionsManager.java	42.85% <100.00%> (ø)
...rch/extensions/rest/RestActionsRequestHandler.java	100.00% <100.00%> (ø)
...org/opensearch/identity/noop/NoopTokenManager.java	100.00% <100.00%> (+33.33%)	⬆️
...rg/opensearch/identity/tokens/BearerAuthToken.java	100.00% <100.00%> (ø)
...g/opensearch/identity/tokens/OnBehalfOfClaims.java	87.50% <87.50%> (ø)
server/src/main/java/org/opensearch/node/Node.java	85.22% <0.00%> (ø)
...ensearch/extensions/rest/ExtensionRestRequest.java	71.59% <33.33%> (-1.67%)	⬇️
...org/opensearch/identity/tokens/BasicAuthToken.java	80.00% <60.00%> (-7.50%)	⬇️
... and 2 more

... and 471 files with indirect coverage changes

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/29452/
• CommitID: d0d38d5
  Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
  Is the failure a flaky test unrelated to your change?

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/29453/
• CommitID: 1b2b65d
  Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
  Is the failure a flaky test unrelated to your change?

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/29454/
• CommitID: 354de07
  Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
  Is the failure a flaky test unrelated to your change?

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: UNSTABLE ❕
• TEST FAILURES:

      1 org.opensearch.search.SearchWeightedRoutingIT.testMultiGetWithNetworkDisruption_FailOpenEnabled

• URL: https://build.ci.opensearch.org/job/gradle-check/29458/
• CommitID: 64504cb
  Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.