[Bug] Cloud Security features (Misconfigurations, Benchmakrs pages) don't work for users in serverless except org owners and admins

[maxcold]

Kibana version:
serverless

Describe the bug:
Users who have access to the Secuirity Project with any role, except Admin, can't access Security > Findings > Misconfigurations and Security > Rules > Benchmarks pages. These pages seem to work only for organisation owners

Steps to reproduce:

1. Create a Security project on cloud.elastic.co
2. As an owner install CSPM integration and wait for data ingestion
3. Go to Project Settings > Users and Roles
4. Invite a user to an organisation with access only to the created project and a role "Editor"
5. Login with this new user to cloud.elastic.co and open the security project
6. Navigate to Security > Rules > Benchmarks or Security > Findings > Misconfigurations (Vulnerabilties most likely also affected) pages and see that the findings or benchmark rules don't load

Expected behavior:
Cloud Security features should be available for users with Editor role, but even better with Editor or Viewer (only read-only features) roles

Screenshots (if relevant):

Errors in browser console (if relevant):
GET /internal/cloud_security_posture/benchmarks 403 (Forbidden)

Provide logs and/or server output (if relevant):

Any additional context:
Initially I thought our features didn't work even with the Admin role, but that's because I wasn't logging out after changing the role (which might be an issue by itself in general, but not specific to us). I updated the issue to note that our features don't work with Editor and Viewer roles
A related issue in ESS

• [Cloud Security] user with access to indexes documented in the public docs can't access CSPM Findings and Dashboard #181896 (comment)

We require specific setup for users to access Cloud Security features, but the access control on Serverless is different, so we need to find a way to make our features work there

@elastic/kibana-cloud-security-posture

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[kfirpeled]

Adding here relevant tickets:

• [Security Solution][Cloud Security] Updates UI FTR tests to not run with operator privileges #184734
• [Security Solution][Cloud Security] Updates API FTR tests to not run with operator privileges #184736

[smriti0321]

@maxcold Thanks for testing this and opening the ticket-

Here is expected behaviour for Viewer and Editor roles.
We aim for consistency in ESS and Serverless for these roles. Both should be able to view the findings and dashboards, only difference between Editor and Viewer should be ability to create detection rules and enable/disable benchmark rule, later should not be able to create detection rule or disable/enable benchmark rules.

[acorretti]

Assigning @opauloh in case it's related to his current issue #188354