2nd attempt at https://github.com/elastic/elasticsearch/issues/84591

references https://github.com/elastic/elasticsearch/issues/48856#issuecomment-831144741

tldr; the permission structure for the endpoint isn't useful for most users. If users can create runtime fields they should have access to this api, they shouldn't need a specific permission set. 
x-pack/qa/runtime-fields/with-security/src/javaRestTest/java/org/elasticsearch/xpack/security/PermissionsIT.java
assertEquals(3, searchResponse.getHits().getTotalHits().value);
        for (SearchHit hit : searchResponse.getHits().getHits()) {
            Map<String, DocumentField> fields = hit.getFields();
            assertEquals(1, fields.size());
            switch (hit.getId()) {
                case "1" -> assertEquals("2009", fields.get("year").getValue().toString());
                case "2" -> assertEquals("2016", fields.get("year").getValue().toString());
                case "3" -> assertEquals("2018", fields.get("year").getValue().toString());
                default -> throw new UnsupportedOperationException();
            }
        }
        {
            FieldCapabilitiesRequest fieldCapsRequest = new FieldCapabilitiesRequest().indices("fls").fields("year");
            FieldCapabilitiesResponse fieldCapabilitiesResponse = adminHighLevelClient.fieldCaps(fieldCapsRequest, RequestOptions.DEFAULT);
            assertNotNull(fieldCapabilitiesResponse.get().get("year"));
        }
        {
            
            FieldCapabilitiesRequest fieldCapsRequest = new FieldCapabilitiesRequest().indices("fls").fields("year");
            FieldCapabilitiesResponse fieldCapabilitiesResponse = highLevelClient.fieldCaps(fieldCapsRequest, RequestOptions.DEFAULT);
            assertEquals(0, fieldCapabilitiesResponse.get().size());
        }
    }
    private static class HighLevelClient extends RestHighLevelClient {
        private HighLevelClient(RestClient restClient) {
            super(restClient, (client) -> {}, Collections.emptyList());
        }
    }
}