[Security Solution] allows kibana_system user to manage .reindexed-v8-* Security Solution indices

[vitaliidm]

• partly addresses https://github.com/elastic/security-team/issues/11414, https://github.com/elastic/security-team/issues/11440
• allows kibana_system user to manage reindexed to v8 indices: .reindexed-v8-siem-signals-*, .reindexed-v8-lists-*, .reindexed-v8-items-*. Reindex is required for every index created in 7.x, before upgrading stack to 9.0.

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[elasticsearchmachine]

Hi @vitaliidm, I've created a changelog YAML for you.

[jakelandis]

Same question here as: #118959 (comment)

Shouldn't the result of the re-indexing via the Kibana upgrade assistant introduce an alias with the old name, which should allow continued access by the old name (without needing to add a new privilege) ?

Assuming the same answer, then LGTM

[azasypkin]

@vitaliidm can you please answer Jake's question in #119054 (review)?

[vitaliidm]

@azasypkin

Answer basically is the same as to #118959 (comment)
We have internal logic that interacts with underlying indices on behalf of kibana_system user and this prefix prevents it.

Two examples:

1. https://github.com/elastic/security-team/issues/11414#issuecomment-2551641279 when we move list indices to data streams
2. https://github.com/elastic/security-team/issues/11440#issuecomment-2553772936 when we create .alerts-security* index and old siem index exists

[elasticsearchmachine]

💚 Backport successful

Status	Branch	Result
✅	8.x