…access (elastic#125900)

It's more natural for `manage` and `manage_data_stream_lifecycle` to
grant access to management style APIs both for regular data streams and
their failure stores.

This PR adds support for privileges to grant access to both data and
failures selectors (without granting access to everything, à la `all`),
and extends `manage` and `manage_data_stream_lifecycle` to grant failure
store access, in addition to regular data stream access.
`manage_failure_store` still grants failures-only access.