Feature Controls - Prevent API tag collisions

[legrego]

See #35841 (comment) for context.

Currently, it's possible for two features to register the same tag for securing access to API endpoints. This can lead to collisions which could cause a user to have access to API endpoints they shouldn't have access to.

Example:

//Feature 1
xpackMain.registerFeature({
   id: 'feature1',
   privileges: {
      all: { api: ['foo'] }
   }
   ...,
});

// Feature 2
xpackMain.registerFeature({
   id: 'feature2',
   privileges: {
      all: { api: ['foo'] }
   }
   ...,
});

With this configuration, a user with access to only Feature 1 would have the ability to execute Feature 2's API endpoints (and vice versa).

With the NP initiative, we should explore alternate approaches to securing endpoints in a way that does not lead to collisions.

[elasticmachine]

Pinging @elastic/kibana-security

[legrego]

note: Some features (like file upload) rely on the current behavior, so we want to allow for two features to grant access to the same API endpoint. Our approach should make this more explicit/intentional, however.