Preserve authentication for self-referential CCS

[cwperks]

Fixes #5846

Summary

• identify direct local transport requests by the exact local DiscoveryNode instance rather than DiscoveryNode.equals
• serialize user context for equal-but-distinct remote node representations, including self-referential CCS
• add regression coverage for a remote connection whose DiscoveryNode equals, but is not identical to, the local node

Validation

• ./gradlew spotlessJavaCheck test --tests org.opensearch.security.transport.SecurityInterceptorTests --tests org.opensearch.security.transport.RestoringTransportResponseHandlerTests
• reproduced with two OpenSearch 3.7.0 clusters and both self-referential and external remote aliases
• before fix: self CCS returned HTTP 500 in 5/5 requests; external CCS returned HTTP 200
• after identity-based fix: self CCS returned HTTP 200 in 5/5 requests; external CCS returned HTTP 200 in 3/3 requests

Note

• ./gradlew precommit reaches an unrelated existing forbidden-API failure in the sample resource plugin for URL.openStream()

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 1815de0)

Here are some key observations to aid the review process:

🧪 PR contains tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Identity check may miss same-node Switching from localNode.equals(connection.getNode()) to reference equality (connection.getNode() == localNode) means that any legitimate same-node local transport path that constructs its own DiscoveryNode instance (equal but not identical) will no longer be treated as a same-node request. This will now go through serialization and copy user headers where it previously skipped them, which could change behavior for local shortcuts that intentionally reuse an equal DiscoveryNode. Confirm that the OpenSearch transport layer always propagates the exact localNode instance for direct-channel same-node requests across all versions supported here. // An equal but distinct node may represent a remote connection back to this node, so use identity for direct local requests. final boolean isSameNodeRequest = localNode != null && connection.getNode() == localNode && !isStreamChannel;

[github-actions]

Persistent review updated to latest commit 1815de0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.81%. Comparing base (22c36ef) to head (1815de0).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6474      +/-   ##
==========================================
+ Coverage   75.78%   75.81%   +0.02%     
==========================================
  Files         457      457              
  Lines       30556    30556              
  Branches     4630     4630              
==========================================
+ Hits        23158    23167       +9     
+ Misses       5274     5265       -9     
  Partials     2124     2124              

Files with missing lines	Coverage Δ
.../opensearch/security/OpenSearchSecurityPlugin.java	84.21% <100.00%> (ø)
...search/security/transport/SecurityInterceptor.java	80.85% <100.00%> (ø)

... and 6 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.