Handle special cases for File.createTempFile

[ldematte]

We were missing a couple of cases where File.createTempFile (from java.io) are defaulting to the default temp directory.
This PR addresses that.

Fixes #130086

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[rjernst]

IIRC I didn't do this because we implicitly allow access to the temp directory for all code, so I only overrode the methods that took in a base dir to create a temp file. This should work though, it just means additional checks (we already grant the tmp dir access automatically in module policies, do we also do that for eg the unnamed module that apm agent uses?)

[ldematte]

It's a good point; at first, I just added a

if (directory != null) {
   // check write to directory. Otherwise skip as we always allow access to the temp directory
}

case to the existing createTempFile overload.

What I did not like about it is that we now have the "we implicitly allow access to the temp directory for all code" policy in yet another place, so I change it this way.
It is a bit more clean IMO as this keeps the policy we have is (I think) in a single place, coded in FileAccessTree.

I'm fine either way really, even just adding the directory != null check.

[ldematte]

we already grant the tmp dir access automatically in module policies, do we also do that for eg the unnamed module that apm agent uses?

Yep, all paths (including APM_MODULE and UNKNOWN) all use a FileAccessTree. They might have a defaultEntitlements / defaultFileAccess (with FilesEntitlement.EMPTY), but we add special permissions like temp or config access in the FileAccessTree ctor.

[rjernst]

LGTM

[elasticsearchmachine]

💚 Backport successful

Status	Branch	Result
✅	9.1
✅	8.19