Ensure that plugin can search on system index when utilizing pluginSubject.runAs

[cwperks]

Description

While testing opensearch-project/job-scheduler#714, I ran into an issue where a plugin was not able to perform search operations on an index when replacing try (ThreadContext.StoredContext ctx = threadContext.stashContext()) { ... } with the new replacement pluginSubject.runAs(() -> { ... }) because the security plugin has logic to scrub the resultset when performing search operations for regular users. This PR updates to codepaths to account for the introduction of pluginSubject as a separate form of a system-level request.

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Bugfix

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 71.44%. Comparing base (2bef10c) to head (1f598f3).
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5032      +/-   ##
==========================================
- Coverage   71.53%   71.44%   -0.09%     
==========================================
  Files         336      336              
  Lines       22617    22621       +4     
  Branches     3599     3600       +1     
==========================================
- Hits        16178    16162      -16     
- Misses       4641     4661      +20     
  Partials     1798     1798              

Files with missing lines	Coverage Δ
...rity/configuration/SystemIndexSearcherWrapper.java	91.52% <100.00%> (ø)
...ecurity/privileges/SystemIndexAccessEvaluator.java	76.92% <100.00%> (ø)
.../security/privileges/dlsfls/DlsFlsBaseContext.java	100.00% <100.00%> (ø)
.../org/opensearch/security/support/HeaderHelper.java	70.00% <100.00%> (+7.50%)	⬆️

... and 8 files with indirect coverage changes

[derek-ho]

Generally LGTM

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/security/backport-2.x
# Create a new branch
git switch --create backport/backport-5032-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 472f7c7979502606ccb0707908ce5f689dde6164
# Push it to GitHub
git push --set-upstream origin backport/backport-5032-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-5032-to-2.x.