[Security for Extensions] Consume access tokens passed from core and utilize in REST Clients

[cwperks]

As part of Security for Extensions there will be 2 types of tokens ferried to an extension to be utilized to make REST Requests back to the OpenSearch cluster. These 2 types of tokens are:

• On-Behalf-Of tokens - these are short-lived access tokens issued on behalf of the currently authenticated user
• Service Account token - This would be a single token issued and ferried over during extension bootstrap and utilized by the extension to make requests on its own behalf, for instance writing to a reserved (system) index

The SDKClient contains methods for initializing clients in an extension for making REST requests back to OpenSearch and the tokens described above will need to be utilized by the clients.

For Extensions Developers, it will need to be clear how to use each type of token described above. In order to make it clearer which token is utilized, I propose to create 2 separate REST Clients:

1. Extension REST Client - This REST Client would always utilize the static service account token (static meaning that there is a single instance of the token at a time.)
2. User REST Client - This REST Client would be initialized at the start of handling a REST Request and would be used to make REST Requests back to OpenSearch on behalf of the authenticated user. Initialization means that the REST Client is provided default HTTP Headers and it would populate the Authorization header with the auth token provided to the REST Handler.

Additional considerations for the REST Clients and Security is that they will need to be setup to use the https:// protocol instead of the default http://. Note that it is possible to disable https in the security plugin (but not transport TLS), so the setting that controls https/http in the security plugin also needs to be ferried over to an extension to determine what scheme to use.

[peternied]

@cwperks Did we want to consider this item for the next security sprint, is it ready for that or out of scope?

[cwperks]

@peternied Its related to this issue: opensearch-project/security#3176

There is a checkbox in there to update this PR to reflect how Service Account Tokens are ferried to an extension. In the implementation in this PR it ferries the token over in a separate transport action that is sent directly after a success extension initialization request.