[ResponseOps][Connectors] Add authMode to connector saved objects and apis

[js-jankisalvi]

Summary

Resolves #250976

This PR introduces a new authMode attribute for connectors that allows configuring authentication modes as either shared (default) or per-user. This enables support for different authentication patterns where connectors can use:

• shared: Single set of credentials shared across all users
• per-user: Individual user credentials for personalized authentication

Key Changes

• New API field: Added optional auth_mode parameter to connector create endpoint
• Saved object schema: Introduced v2 schema with authMode field support
• Data migration: Model version 2 automatically backfills authMode: 'shared' for existing connectors that have config.authType set

Note: Update API does not support authMode as of now.

How to test

1. Create two connectors in main one with authType and one without

curl -X POST "http://localhost:5601/api/actions/connector" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "name": "My Webhook Connector",
    "connector_type_id": ".webhook",
    "config": {
        "url": "https://api.example.com/webhook",
        "method": "post",
        "hasAuth": true,
        "authType": "webhook-authentication-basic", 
        "headers": {
          "Content-Type": "application/json"
        }
      },
    "secrets": {
      "user": "admin",
      "password": "secret"
    },
  }'

• Checkout this PR and restart kibana
• Verify that connector with authType has authMode: shared and connector without authType doesn't

  curl -X GET "http://localhost:5601/api/actions/connectors" \
    -H "kbn-xsrf: true" \
    -u elastic:changeme
  

2. Create connector with authMode

curl -X POST "http://localhost:5601/api/actions/connector" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "name": "Shared Auth Webhook",
    "connector_type_id": ".webhook",
    "config": {
      "url": "https://example.com/webhook",
      "method": "post"
    },
    "secrets": {
      "user": "admin",
      "password": "secret"
    },
    "auth_mode": "shared"
  }'

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Release note:

Create a connector with auth_mode attribute

[js-jankisalvi]

Closing this PR in favour of #252262. Updated target branch to feature branch connectors-auth-code-grant. Will address open feedback in new PR.

[js-jankisalvi]

Is this only used to determine if a human controls the creds, to make it easier to identify, to allow them to "refresh" them? That's kinda what I get from the description of the changes, but the top level description says

new authMode attribute for connectors that allows configuring authentication modes as either shared (default) or per-user

After seeing that, I was thinking we'd be maintaining multiple sets of Secrets on a per-user basis, to use when the connector is executed. Except I know we don't really have a concept of "users" like that anyway, so seems unlikely we'd do that.

So, I just wanted to make sure this story doesn't include a multi-Secrets-per-Connector requirement. If so, I wonder if we can change the terms we're using, as I think customer's might get confused. Thinking they could use the same PagerDuty connector with different userids, or similar.

Also, is this mainly just relevant for OAuth stuff? Seems possible. If so, I think that's worth noting in the description ...

Addressed here