Test unknown named application privileges

[n1v0lg]

POST /_security/privilege
{
    "kibana": {
        "read": {
            "actions": [
                "data:read/*"
            ]
        }    
    }
}

PUT /_security/role/test
{
    "cluster": [
        "manage_security"
    ],
    "applications": [
        {
            "application": "kibana",
            "privileges": [
                "create"
            ],
            "resources": [
                "*"
            ]
        }
    ]
}

PUT /_security/user/test-admin
{
    "password": "elastic-password",
    "roles": [
        "test"
    ]
}

// run by `test-admin` 
GET /_security/user/_has_privileges
{
    "application": [
        {
            "application": "kibana",
            "privileges": [
                "create"
            ],
            "resources": [
                "*"
            ]
        }
    ]
}
// returns `true` for `create` as expected

PUT /_security/role/test
{
    "cluster": [
        "manage_security"
    ],
    "applications": [
        {
            "application": "kibana",
            "privileges": [
                "create",
                "update"
            ],
            "resources": [
                "*"
            ]
        }
    ]
}

// same has privileges call again
GET /_security/user/_has_privileges
{
    "application": [
        {
            "application": "kibana",
            "privileges": [
                "create"
            ],
            "resources": [
                "*"
            ]
        }
    ]
}
// returns `false` for `create` -> unexpected

[n1v0lg]

Only difference between the roles: "single" unknown privilege or unknown privilege + plus another (known or unknown, doesn't matter).

[n1v0lg]

This fails but shouldn't.

[n1v0lg]

This is the problem:

elasticsearch/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ApplicationPermission.java

Line 194 in 79f801b

if (this.privilege.equals(other)) {

We are checking for equality, but when there's more than one privilege on the Role, we fail this check since name is Set.of("create", "read") for the privilege on the role, and it does not equal Set.of("read") -- the privilege from the request (i.e., other)

[n1v0lg]

This works and is expected behavior based on: #33928 (comment)