Enforce filter-expression permission by default in v2.17

[julianbrost]

This is a followup change for #10909, which was included in the v2.16.2, v2.15.4, and v2.14.9 releases and adds a new filter-expression permission to Icinga 2. As that's an incompatible change, this permission is not enforced by default yet (users need to opt-in), but the documentation and log messages already announce that this will change in v2.17.

This PR now adds exactly those changes: it changes the default of the (also newly added in #10909) enforce_filter_expression_permission config option to true and marks it as deprecated so that users are disencouraged from disabling it, but rather add the filter-expression to ApiUser objects instead. The documentation is also updated accordingly.

Our own API consumers should not be affected by this. I've asked about this (also in internal chats), and only Icinga DB, which - according to #10919 (review) - does not use filter expression, and Icinga Director, which asks for a wildcard permission, came up.

[julianbrost]

I wouldn't want to merge this just yet, see the TODO I added in the description (tl;dr: checking effects of the change on Icinga 2 API consumers like Icinga DB).

[Al2Klimov]

That's not how Icinga DB web filters objects:

https://github.com/Icinga/icingadb-web/blob/b7da98fa3adac427436152654b936612caf9ae4e/library/Icingadb/Command/Renderer/IcingaApiCommandRenderer.php#L79-L81

[julianbrost]

I wouldn't want to merge this just yet, see the TODO I added in the description (tl;dr: checking effects of the change on Icinga 2 API consumers like Icinga DB).

Should be fine, see updates PR description. I've also rebased for up-to-date GH Actions.

[julianbrost]

Asked about this internally some time ago, got no complaints, and some hints that this should be fine. So merging this after a rebase for up-to-date actions.