docs: Add required privileges for using API Keys

[bmorelli25]

Motivation/summary

• This PR adds the required privileges for using API keys. Previously, we didn't do a good job of calling out the manage_api_cluster privilege, or of providing an example of how to set apm application privileges.

• This PR adds an example workflow for creating an API key using the ES create API key API. The process used is these docs was originally documented here.

Server CLI tested with:

PUT _security/role/apm_api_key
{
  "cluster": [
    "manage_api_key"
  ],
  "applications": [
    {
      "application": "apm",
      "privileges": [
        "sourcemap:write",
        "event:write",
        "config_agent:read"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

./apm-server apikey create --name java-001

PUT _security/role/apm_api_key_sm
{
  "cluster": [
    "manage_api_key"
  ],
  "applications": [
    {
      "application": "apm",
      "privileges": [
        "sourcemap:write"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

./apm-server apikey create --sourcemap --name java-002

PUT _security/role/apm_api_key_ev
{
  "cluster": [
    "manage_api_key"
  ],
  "applications": [
    {
      "application": "apm",
      "privileges": [
        "event:write"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

./apm-server apikey create --ingest --name java-003

PUT _security/role/apm_api_key_cf
{
  "cluster": [
    "manage_api_key"
  ],
  "applications": [
    {
      "application": "apm",
      "privileges": [
        "config_agent:read"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

./apm-server apikey create --agent-config --name java-004

ES version tested with:

POST /_security/api_key
{
  "name": "java-002",
  "expiration": "1d", 
  "role_descriptors": { 
    "apm": {
      "applications": [
        {
          "application": "apm",
          "privileges": ["sourcemap:write", "event:write", "config_agent:read"],
          "resources": ["*"]
        }
      ]
    }
  }
}

echo -n GnrUT3QB7yZbSNxKET6d:RhHKisTmQ1aPCHC_TPwOvw | base64

apm-server apikey verify --credentials R25yVVQzUUI3eVpiU054S0VUNmQ6UmhIS2lzVG1RMWFQQ0hDX1RQd092dw==

Related issues

Closes #3566.
Closes #4135.

Additional work

After this PR is approved, a separate PR will need to be opened in the Beats repo to persist these changes: elastic/beats#20911

[apmmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #4130 updated]

• Start Time: 2020-09-09T02:13:45.373+0000

• Duration: 4 min 2 sec

[axw]

Looks good! Just a few minor things.

[axw]

nice 👍