Add license gating to Graph API

[albertoblaz]

Summary

Closes https://github.com/elastic/security-team/issues/16082.

How to test

1. Stateful with a basic/gold license — Start ES with basic license using yarn es snapshot --license basic. Call POST /internal/cloud_security_posture/graph with a valid body. Expect a 403 Forbidden with the message "Graph visualization requires a Platinum license or higher."

2. Stateful with a platinum+ license — Same request should succeed (or return a normal data response / empty result).

3. Serverless essentials tier — Start ES in serverless mode with yarn es serverless --projectType security --kill and Kibana with yarn serverless-security. Add these lines to your kibana.dev.yml:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'security', product_tier: 'essentials' },
    { product_line: 'endpoint', product_tier: 'essentials' },
    { product_line: 'cloud', product_tier: 'essentials' },
  ]

The route should not be registered (404).

4. Serverless complete tier — Remove added lines to kibana.dev.yml. The route should be accessible and return data normally.

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Low risk of exposing Graph API when shouldn't be reachable.

[elasticmachine]

Pinging @elastic/contextual-security-apps (Team:Cloud Security)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c219752
• Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-255989-c2197525583b

Metrics [docs]

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
@kbn/test-suites-xpack-security	70	71	+1

Total ESLint disabled count

id	before	after	diff
@kbn/test-suites-xpack-security	72	73	+1

History

• 💔 Build #404481 failed 952c8b9
• 💔 Build #404389 failed 952c8b9

cc @albertoblaz