[Security Solution] Implement prebuilt rule upgrade/_perform API endpoint

[banderror]

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Related to: #144060, #148181

Summary

Based on the API design made in #144060, implement the new rule upgrade/_perform API endpoint and hide it behind the feature flag.

POST /internal/detection_engine/prebuilt_rules/upgrade/_perform

Request body:

export interface PerformRuleUpgradeRequestBody {
  mode: 'ALL_RULES' | 'SPECIFIC_RULES';
  pick_version?: 'BASE' | 'CURRENT' | 'TARGET' | 'MERGED';
  rules: RuleUpgradeSpecifier[]; // required if mode is SPECIFIC_RULES
}

export interface RuleUpgradeSpecifier {
  rule_id: RuleObjectId;
  pick_version?: 'BASE' | 'CURRENT' | 'TARGET' | 'MERGED';
  fields?: {
    name?: FieldUpgradeRequest<RuleName>;
    description?: FieldUpgradeRequest<RuleDescription>;
    // etc
    // Every non-specified field will default to pick_version: 'MERGED'.
    // If pick_version is MERGED and there's a merge conflict the endpoint will throw.
  };

  /**
   * The target version to upgrade to.
   */
  version: number;

  /**
   * This parameter is needed for handling race conditions with Optimistic Concurrency Control.
   * Two or more users can call upgrade/_review and upgrade/_perform endpoints concurrently.
   * Also, in general the time between these two calls can be anything.
   * The idea is to only allow the user to upgrade a rule if the user has reviewed the exact revision
   * of it that had been returned from the _review endpoint. If the revision changed on the BE,
   * upgrade/_perform endpoint will return a revision mismatch error for this rule.
   */
  revision: number;
}

export interface FieldUpgradeRequest<T> {
  pick_version: 'BASE' | 'CURRENT' | 'TARGET' | 'MERGED' | 'RESOLVED';
  resolved_value: T; // required if pick_version is RESOLVED; type depends on the rule field type
}

Response body:

export interface PerformRuleUpgradeResponseBody {
  summary: {
    total: number;
    succeeded: number;
    skipped: number;
    failed: number;
  };
  results: {
    updated: RuleResponse[];
    skipped: Array<{
      rule_id: RuleSignatureId;
      reason_code: 'RULE_UP_TO_DATE';
    }>;
  };
  errors: AggregatedPrebuiltRuleError[];
}

interface AggregatedPrebuiltRuleError {
  message: string;
  status_code?: number;
  rules: Array<{
    rule_id: string;
    name?: string;
  }>;
}

Todo

• Initial implementation (PR)
• Rule upgrade: Missing the ability to pick the MERGED version for rule upgrades, but it is not needed so long as we do not allow rule modification
• Rule upgrade: Missing the ability to specify rule field versions to pick

Follow-up work will be done in #166376

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

Follow-up work will be done in #166376