[JENKINS-72042] Add permission to manage config files

[mawinter69]

Also JENKINS-63430

Add 2 permissions, one to manage global files and one to manage files on folder level

With the permission to manage global files but no Manage Permissions, a root action is added so one can access the configfiles url easily.

Questions:

Should the permission maybe not be enabled by default but only after setting a system property at startup?

Testing done

Integrated tests are fine

Also checked locally with a user granting the permissions that the links appear and config files can be edited.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[mawinter69]

That way of checking the permissions looked wrong. It basically meant that for folders only with extended_read and use_item the credentials get filled. This is also different from

config-file-provider-plugin/src/main/java/org/jenkinsci/plugins/configfiles/custom/security/CustomizedCredentialMapping.java

Line 97 in 6b4fd13

if (!item.hasPermission(Item.EXTENDED_READ)

where only one of the permissions is needed.
Also use_item is a permission that is disabled by default.

[tomas-bezdek-jpmc]

@mawinter69 I was just talking to my team few days ago about separate permissions for managed files, what a coincidence :) If it's not too much to ask, would you be open to add a set of permissions for read-only access?

[mawinter69]

You mean something so you can read the files without SYSTEM_READ on global level or EXTENDED_READ on folder level? See also https://issues.jenkins.io/browse/JENKINS-76000 and https://issues.jenkins.io/browse/JENKINS-76001