2nd attempt at https://github.com/elastic/elasticsearch/issues/84591

references https://github.com/elastic/elasticsearch/issues/48856#issuecomment-831144741

tldr; the permission structure for the endpoint isn't useful for most users. If users can create runtime fields they should have access to this api, they shouldn't need a specific permission set. 
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/action/SecurityActionMapper.java
static final String CLUSTER_PERMISSION_SCROLL_CLEAR_ALL_NAME = "cluster:admin/indices/scroll/clear_all";
    static final String CLUSTER_PERMISSION_ANALYZE = "cluster:admin/analyze";
    /**
     * Returns the security specific action name given the incoming action name and request
     */
    public static String action(String action, TransportRequest request) {
        switch (action) {
            case ClearScrollAction.NAME -> {
                assert request instanceof ClearScrollRequest;
                boolean isClearAllScrollRequest = ((ClearScrollRequest) request).scrollIds().contains("_all");
                if (isClearAllScrollRequest) {
                    return CLUSTER_PERMISSION_SCROLL_CLEAR_ALL_NAME;
                }
            }
            case AnalyzeAction.NAME, AnalyzeAction.NAME + "[s]" -> {
                assert request instanceof AnalyzeAction.Request;
                String[] indices = ((AnalyzeAction.Request) request).indices();
                if (indices == null || (indices.length == 1 && indices[0] == null)) {
                    return CLUSTER_PERMISSION_ANALYZE;
                }
            }
        }
        return action;
    }
}