Support asynchronous Security configuration APIs with wait_for_completion

[cwperks]

Description

Security configuration APIs such as create/update role currently execute synchronously and do not expose their work through the OpenSearch task framework. This makes it difficult for clients to submit configuration changes without holding an HTTP connection open, monitor progress, or distinguish an in-progress operation from a lost request.

Add support for the standard wait_for_completion query parameter to Security configuration write APIs, starting with role create/update and ideally using a shared implementation for other applicable Security REST APIs.

Proposed behavior

• Preserve backwards compatibility by defaulting wait_for_completion to true.
• With wait_for_completion=true, wait for the operation to complete and return the existing API response.
• With wait_for_completion=false, submit the operation through the OpenSearch task framework and immediately return its task ID.
• Allow callers to query the task through the standard Tasks API, for example GET /_tasks/{task_id}.
• Ensure the task represents the full configuration update lifecycle, including persistence and any cluster-wide propagation/acknowledgement the API currently waits for.
• Define completed-task result/error retention using the established task framework conventions rather than a Security-specific status mechanism.

Example:

PUT /_plugins/_security/api/roles/my_role?wait_for_completion=false

{
  "task": "node-id:task-id"
}

Initial scope

At minimum:

• create role
• update role

The implementation should identify other Security configuration write endpoints that can use the same infrastructure, such as users, role mappings, action groups, tenants, and configuration updates.

Acceptance criteria

• Security configuration write APIs accept wait_for_completion.
• Existing clients observe no response behavior change when the parameter is omitted.
• wait_for_completion=false returns a valid task ID without waiting for the operation to finish.
• Task status, completion, failure, and cancellation semantics are exposed consistently through the OpenSearch task framework.
• Authorization for submitting and inspecting tasks does not expose Security configuration contents to unauthorized users.
• Integration tests cover synchronous success/failure, asynchronous success/failure, and task lookup.