[ResponseOps] Require all privilege to "Actions and Connectors" in order to execute SentinelOne sub-actions

[paul-tavares]

Summary

• Adds an additional authz check to the execution of SentinelOne sub-actions to ensure the user has the all privilege to "Actions and Connectors"

Testing

In order to test this change the SentinelOne connector needs to be enabled by setting the following config property:

xpack.stack_connectors.enableExperimental:
  - sentinelOneConnectorOn

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[paul-tavares]

buildkite test this

[paul-tavares]

buildkite test this

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 31ab253

Metrics [docs]

✅ unchanged

History

• 💔 Build #178265 failed 4965d4a
• 💔 Build #178252 failed 4965d4a
• 💔 Build #178248 failed 4965d4a
• 💚 Build #176958 succeeded 50a4f00
• 💛 Build #176148 was flaky dc771a3

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

[mikecote]

Changes LGTM but I noticed the UI doesn't reflect the updated RBAC changes:

• "Run this connector" button in the connectors list is still visible for SentinelOne connector when the user is read only
• "Test" tab is visible when opening the connector flyout for a read only user
• SentinelOne connector shows up as an action to alerting rules when user is read only

We'll need these bugs fixed before a EDR connector becomes GA. Is this something you would like to fix in this PR or would like to defer to a later time? We can provide code pointers.