Update JWT documentation to recommend only using jwt_header or audit logging not both

[stephen-crawford]

Description

Because of the interaction between the audit logging system and custom REST headers, it is recommended users only use either custom JWT headers or audit logging; not both. If a user configures a custom JWT header other than Authorization the audit log may record the JWT passed in requests. This can then be parsed from the logs or potentially re-used depending on the user's construction of the token.

A long term fix for this scenario will be pursued but this change should be made to notify users in the meantime.

Checklist

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
  For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[hdhalter]

Thanks, @scrawfor99 ! Is this ready for doc review? And does it have an associate issue?

[stephen-crawford]

Hi @hdhalter it should be all set for doc review. This is the associated issue: opensearch-project/security#3875

[hdhalter]

Thanks, @scrawfor99 - Is backporting to 2.11 and 1.3 appropriate?

[stephen-crawford]

Hi @hdhalter yep!

[Naarcha-AWS]

Make sure that my changes retain the intended meaning.

[opensearch-trigger-bot]

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/backport-1.3 1.3
# Navigate to the new working tree
pushd ../.worktrees/backport-1.3
# Create a new branch
git switch --create backport/backport-5914-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7d8a6a379d2307b60f171a3d8e1a59edeb2a6488
# Push it to GitHub
git push --set-upstream origin backport/backport-5914-to-1.3
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-5914-to-1.3.

[opensearch-trigger-bot]

The backport to 2.11 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/backport-2.11 2.11
# Navigate to the new working tree
pushd ../.worktrees/backport-2.11
# Create a new branch
git switch --create backport/backport-5914-to-2.11
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7d8a6a379d2307b60f171a3d8e1a59edeb2a6488
# Push it to GitHub
git push --set-upstream origin backport/backport-5914-to-2.11
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/backport-2.11

Then, create a pull request where the base branch is 2.11 and the compare/head branch is backport/backport-5914-to-2.11.