[Backport 1.3] Add early rejection from RestHandler for unauthorized requests (#3418)

[peternied]

Description

Includes:

• Backport f7c47af of Add early rejection from RestHandler for unauthorized requests #3418
• Backport 2dab119 of Use BytesRestResponse constructor with contentType in asRestResponse #3717
• Backport f27dee2 of Use new instance of Decompressor on channel initialization #3583

---

Previously unauthorized requests were fully processed and rejected once they reached the RestHandler. This allocations more memory and resources for these requests that might not be useful if they are already detected as unauthorized. Using the headerVerifer and decompressor customization from [1], perform an early authorization check when only the headers are available, save an 'early response' for transmission and do not perform the decompression on the request to speed up closing out the connection.

graph TD

    oA["Receive Request Headers<br>(Orginal)"] --> oB[Decompress Request]
    oB --> oC[RestHandler]
       oC --> osrf[Intercept Request]
    subgraph sp[Security Plugin]
       osrf --> oD[Check Authorization]
       oD --> oE{Authorized?}
       oE -->|Yes| oF[Process and Respond]
       oE -->|No| oG[Reject Request]
   end
   oF --> oH[Forward to Request Handler]



    H["Receive Request Headers<br>(Updated)"] --> I[HeaderVerifier]
    subgraph nsp[Security Plugin]
       I --> J{Authorized?}
       J -->|Yes| K[Decompress Request]
       J -->|No| N[Save Early Response]
    end
    K --> L[RestHandler]
    N --> L
    L --> M[Intercept Request]
    subgraph n2sp[Security Plugin]
       M --> n2D["Check Authorization<br>(Cached)"]
       n2D --> nE{Authorized?}
       nE -->|Yes| nF[Process and Respond]
       nE -->|No| nG[Reject Request]
   end
   nF --> nH[Forward to Request Handler]

class oA,oB old;
class H,I,K,N,n2D new;
classDef old fill:#f9d0c4,stroke:#f28b82;
classDef new fill:#cfe8fc,stroke:#68a9ef;

Loading

Issues Resolved

• Related [Backport 1.3] Add early rejection from RestHandler for unauthorized requests #3559

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[peternied]

I've tested this change locally - CI won't start passing until the related change in core has been merged [1].

• [1] [Backport 1.3] Allow customization of netty channel handles before and during decompression (#10261) OpenSearch#11086