### Description

**Requirement:**
Threat Intelligence (TI) data providers generate data in the form of indicators of compromise (IOCs). The threat landscape is always evolving and therefore the IOCs need to update to reflect the current state or expired when the indicators are no longer relevant.

As a user of indictor match rules I only want to match against the latest IOCs only.
As a threat intel provider I want to be able to update or expire IOCs that my customers store.

**Support:**
- Using `latest` transform in Elasticsearch to maintain "latest" index that only contains latest IOCs and not the expired ones.

**Current Issue:**
- In current scenario, when installing the integration with the transform, following error is received: `Error installing ti_recordedfuture 1.6.0: security_exception: [security_exception] Reason: action [indices:admin/create] is unauthorized for service account [elastic/kibana] on indices [logs-ti_recordedfuture_latest.threat], this action is granted by the index privileges [create_index,manage,all]`. Reference: https://github.com/elastic/integrations/pull/5460
- It seems like the service account `elastic/kibana` which is automatically used for installing the integration/assets doesn't seem to contain necessary privileges required on destination index, which needs `index, read, create_index, delete` permissions. It also needs a `read` on source indices.
- The other permissions, namely `view_index_metadata` and `manage_transform` are already added to the `elastic/kibana` service account.

Need to[ setup required permissions onto ](https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java#L682)`kibana_system` on all TI destination indices required to support IOC expiration using transforms.

Update: Would also need additional permissions to manage ILM on source indices. Refer: https://github.com/elastic/elasticsearch/issues/94505#issuecomment-1493866234
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java
randomFrom(WriteRequest.RefreshPolicy.values())
            );
        assertThat(kibanaRole.cluster().check(UpdateProfileDataAction.NAME, updateProfileDataRequest, authentication), is(false));
        
        assertThat(kibanaRole.runAs().check(randomAlphaOfLengthBetween(1, 12)), is(false));
        assertThat(kibanaRole.cluster().check(DelegatePkiAuthenticationAction.NAME, request, authentication), is(true));
        assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(mockIndexAbstraction("foo")), is(false));
        assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(mockIndexAbstraction(".reporting")), is(false));
        assertThat(
            kibanaRole.indices().allowedIndicesMatcher("indices:foo").test(mockIndexAbstraction(randomAlphaOfLengthBetween(8, 24))),
            is(false)
        );
        Arrays.asList(
            ".kibana",
            ".kibana-devnull",
            ".reporting-" + randomAlphaOfLength(randomIntBetween(0, 13)),
            ".apm-agent-configuration",
            ".apm-custom-link",
            ".apm-source-map",
            ReservedRolesStore.ALERTS_LEGACY_INDEX + randomAlphaOfLength(randomIntBetween(0, 13)),
            ReservedRolesStore.ALERTS_BACKING_INDEX + randomAlphaOfLength(randomIntBetween(0, 13)),
            ReservedRolesStore.ALERTS_INDEX_ALIAS + randomAlphaOfLength(randomIntBetween(0, 13)),
            ReservedRolesStore.PREVIEW_ALERTS_INDEX_ALIAS + randomAlphaOfLength(randomIntBetween(0, 13)),
            ReservedRolesStore.PREVIEW_ALERTS_BACKING_INDEX_ALIAS + randomAlphaOfLength(randomIntBetween(0, 13)),
            ReservedRolesStore.LISTS_INDEX + randomAlphaOfLength(randomIntBetween(0, 13)),
            ReservedRolesStore.LISTS_ITEMS_INDEX + randomAlphaOfLength(randomIntBetween(0, 13))
        ).forEach(index -> assertAllIndicesAccessAllowed(kibanaRole, index));
        
        Arrays.asList(".monitoring-" + randomAlphaOfLength(randomIntBetween(0, 13))).forEach((index) -> {
            logger.info("index name [{}]", index);