Add notifications_send_access reserved role

Adds a reserved role that can send messages through existing
Notifications channels without being able to create, update or delete
them: cluster:admin/opensearch/notifications/feature/send, plus
channels/get and features so the caller can choose a channel.

Related: opensearch-project/notifications#1279
Signed-off-by: Surya Sashank Nistala <snistala@amazon.com>

Author: eirsep

config/roles.yml

@@ -352,6 +352,14 @@ notifications_read_access:
     - 'cluster:admin/opensearch/notifications/configs/get'
     - 'cluster:admin/opensearch/notifications/features'
 
+# Allows users to send messages through existing Notifications channels
+notifications_send_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opensearch/notifications/channels/get'
+    - 'cluster:admin/opensearch/notifications/feature/send'
+    - 'cluster:admin/opensearch/notifications/features'
+
 # Allows users to use all snapshot management functionality
 snapshot_management_full_access:
   reserved: true