Openapi: adding privileges

[l-trotta]

Closes #4303.

There was no desired output in the original issue, so I'm not sure if this is the format expected. Let me know and I'll change it!

[l-trotta]

validation failing because this adds a new field to the openapi output, will be fixed in case that's how we want to add the information

[lcawl]

My two cents is that of the three options I mentioned in #4303 (comment), "an addendum tacked onto the beginning or end of the operation's "description" field" is likely the best current option since it aligns with what Kibana's doing. Otherwise I think if we went the extension route we'd need a more open-ended structure since the privileges in the Kibana and Cloud API docs would need different options than "cluster-privileges" and "index-privileges".

[georgewallace]

Coming into this one a little late but I do agree with @lcawl if we already have a team doing this a different way then we should follow suit to stay consistent. I do think long term keeping these as separate fields makes the most sense though. @lcawl is this what you are talking about?