add a runWithSecurity task for gradle

[Swiddis]

Description

I swear we had a way to run with security before, but I couldn't find any docs for it, or other references within the Gradle config itself. It's possible it's either buried under some setting or something. In either case, it seems a lot clearer to just have a plain runWithSecurity task, the same way we have integTestWithSecurity.

Related Issues

Need security plugin for my current dev.

Check List

• New functionality includes testing.
• New functionality has been documented.
• New functionality has javadoc added.
• New functionality has a user manual doc added.
• New PPL command checklist all confirmed.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff or -s.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit a38ed6e.

Path	Line	Severity	Description
plugin/build.gradle	367	high	Plugin loaded from a local binary file at '$projectDir/bin/opensearch-security-snapshot.zip' rather than from a verified package registry. This is a supply chain risk — the contents of the zip cannot be verified by reviewers without inspecting the binary artifact directly. Per mandatory flagging rules, all dependency/build plugin changes must be flagged regardless of apparent legitimacy.
plugin/build.gradle	409	medium	Hardcoded admin credentials ('admin'/'admin') are added to the cluster node credential list. Even in a local dev cluster, embedding default superuser credentials in version-controlled build scripts can leak into non-dev environments if the cluster configuration is reused or copied.
plugin/build.gradle	393	medium	'plugins.security.allow_unsafe_democertificates' is explicitly set to 'true'. Demo certificates are well-known and publicly available; if this cluster is ever reachable beyond localhost, TLS provides no real protection. The setting name itself signals the risk ('unsafe'), and it warrants confirmation that this configuration cannot be applied to non-local environments.
plugin/build.gradle	392	low	'plugins.security.ssl.http.enabled' is set to 'false', meaning HTTP traffic to the cluster is unencrypted. Combined with a security plugin and demo certificates, the asymmetry (transport encrypted, HTTP not) could mislead users into thinking the cluster is fully secured.

The table above displays the top 10 most important findings.

Total: 4 | Critical: 0 | High: 1 | Medium: 2 | Low: 1

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.87%. Comparing base (ccb58da) to head (53b6290).
⚠️ Report is 4 commits behind head on main.

❌ Your project check has failed because the head coverage (63.87%) is below the target coverage (99.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #5878      +/-   ##
============================================
+ Coverage     63.78%   63.87%   +0.09%     
- Complexity     9063     9091      +28     
============================================
  Files           962      962              
  Lines         40974    41033      +59     
  Branches       4653     4668      +15     
============================================
+ Hits          26136    26211      +75     
+ Misses        13962    13944      -18     
- Partials        876      878       +2     

Flag	Coverage Δ
sql-engine	63.87% <ø> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.