Analyze and get templates index action privileges

[albertzaharovits]

The indices:admin/analyze and indices:admin/template/get actions currently require the manage index privilege. manage is too broad and it would be more desirable that callers of these actions require a much more restricted privilege. Given the current structure, I suggest we move them under view_index_metadata.

For reference here are all the actions of an indices admin client:

# monitor
indices:monitor/stats
indices:monitor/recovery
indices:monitor/segments
indices:monitor/shard_stores
indices:monitor/upgrade

# view_index_metadata
indices:monitor/settings/get
indices:admin/aliases/get
indices:admin/get
indices:admin/mapping/get
indices:admin/mappings/fields/get
indices:admin/validate/query
indices:admin/ilm/explain (not an indices admin client operation, yet?)

# manage
indices:admin/create
indices:admin/delete
indices:admin/close
indices:admin/open
indices:admin/aliases
indices:admin/upgrade
indices:admin/template/put
indices:admin/resize
indices:admin/settings/update
indices:admin/mapping/put
indices:admin/template/delete
indices:admin/rollover
indices:admin/cache/clear

indices:admin/refresh
indices:admin/flush
indices:admin/synced_flush
indices:admin/forcemerge

indices:admin/analyze
indices:admin/template/get

Related #29998

[elasticmachine]

Pinging @elastic/es-security (:Security/Authorization)

[tdmalone]

Possibly also related: #53110

[kunisen]

any updates here?

[tvernum]

@kunisen No. If the issue is unassigned and has no recent comment or a link to a PR, then it is generally safe to assume that nothing has changed.

[andrassy]

👍

Also relates to elastic/kibana#36635 - it's hard to make a read-only Kibana user where autocomplete works properly in Kibana Dev Tools. The Kibana POST to `/api/console/proxy?path=_template&method=GET' results in a security exception and all autocomplete fails to operate:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "action [indices:admin/template/get] is unauthorized for user [...]"
      }
    ],
    "type" : "security_exception",
    "reason" : "action [indices:admin/template/get] is unauthorized for user [...]"
  },
  "status" : 403
}