Keep the pre-graduation resource sharing setting names working, deprecated

[DarshitChanpura]

Description

Graduating resource sharing out of experimental (#6348) renamed the two feature-flag settings and dropped the old names outright:

Before	After
plugins.security.experimental.resource_sharing.enabled	plugins.security.resource_sharing.enabled
plugins.security.experimental.resource_sharing.protected_types	plugins.security.resource_sharing.protected_types

• Category: Enhancement

Why this is needed. As merged, an existing cluster has to be reconfigured before it can upgrade. A node whose opensearch.yml still carries an old key does not start, and a persistent cluster setting stored under an old key is archived during the upgrade, returning the feature to its default of disabled. Consumers then fall back to their own access control rather than reporting an error — for example ModelAccessControlHelper.shouldUseResourceAuthz returns false and model group access reverts to backend-role filtering — so existing shares stop being honored with no signal to the operator.

Old behavior: the pre-graduation names are unknown settings. Node startup fails on opensearch.yml; cluster settings are archived and the feature silently reverts to disabled.

New behavior: the pre-graduation names are deprecated aliases that still work, and the operator is told to move.

• Each current setting declares its pre-graduation setting as a fallback. The fallback resolves at read time against whichever Settings instance is supplied, so it covers opensearch.yml, cluster settings, and dynamic updates alike. The current name takes precedence when both are set, so a leftover old key cannot override a deliberate new one.
• The old settings are registered and marked Property.Deprecated. Registration is also what lets the upgraders resolve them, since the upgrade path looks the old setting up before rewriting it.
• A SettingUpgrader per setting rewrites an old key to the current one during cluster-state recovery and on any cluster settings update that still uses it, so an upgraded cluster stops carrying the deprecated key instead of keeping it indefinitely.
• The deprecation warning core emits does not name a replacement by design (Setting#checkDeprecation), so each setting logs an explicit warning naming the current key when the old one is in use.

This matches how the plugin already handles the opendistro-to-opensearch rename of ssl_dual_mode_enabled in SecuritySettings, where the legacy setting is kept as a deprecated fallback rather than removed. It is also consistent with core, which kept search.concurrent_segment_search.enabled registered and deprecated when that setting was superseded.

RESOURCE_SHARING_AND_ACCESS_CONTROL.md is updated to describe the deprecation rather than a breaking rename. A companion documentation-website change is at opensearch-project/documentation-website#13072.

Issues Resolved

Follow-up to #6348. Related to #4500

Not a backport. No new permissions, so no security dashboards plugin PR is needed.

Testing

New ResourceSharingSettingMigrationTests (12 tests) covers:

• fallback resolution for both settings, and the default when neither key is set
• precedence when both the old and current keys are set
• a settings instance carrying the old keys passing node-setting validation, which is what determines whether a node with an old key in opensearch.yml starts, with a genuinely unknown key still rejected as the negative control
• the upgraders' target setting and key mapping
• ClusterSettings#upgradeSettings rewriting both old keys, and leaving settings already on the current names untouched
• the legacy settings reporting as deprecated

Verified green (12/12 from the JUnit XML). Negative-controlled twice: removing the fallback wiring fails the fallback tests, and unregistering the legacy settings fails both the node-validation and the upgrade-rewrite tests — confirming registration is what keeps such a node startable.

Note that ./gradlew compileJava across all subprojects fails on main untouched, with an httpclient5/httpcore5 version conflict in opensearch-sample-resource-plugin against the 3.9.0-SNAPSHOT REST client. That is unrelated to this change; ./gradlew :compileJava is clean.

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit bb835aa)

Here are some key observations to aid the review process:

🧪 PR contains tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

Persistent review updated to latest commit bb835aa

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.97%. Comparing base (c59f017) to head (bb835aa).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...es/settings/ResourceSharingFeatureFlagSetting.java	75.00%	1 Missing and 1 partial ⚠️
...ings/ResourceSharingProtectedResourcesSetting.java	77.77%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6513      +/-   ##
==========================================
+ Coverage   75.90%   75.97%   +0.06%     
==========================================
  Files         461      461              
  Lines       30920    30940      +20     
  Branches     4668     4668              
==========================================
+ Hits        23471    23506      +35     
+ Misses       5288     5275      -13     
+ Partials     2161     2159       -2     

Files with missing lines	Coverage Δ
.../opensearch/security/OpenSearchSecurityPlugin.java	84.16% <100.00%> (+0.04%)	⬆️
...g/opensearch/security/support/ConfigConstants.java	96.55% <ø> (ø)
...es/settings/ResourceSharingFeatureFlagSetting.java	92.00% <75.00%> (-8.00%)	⬇️
...ings/ResourceSharingProtectedResourcesSetting.java	90.90% <77.77%> (-9.10%)	⬇️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.