Settings should be validated at parse time

[danhermann]

The monitoring settings below are currently validated at usage time meaning that they can be accepted into the cluster state when invalid thereby poisoning the cluster state with the invalid setting. All of the following should be validated as part of the settings validation framework which will eliminate this problem.

• AUTH_USERNAME_SETTING (Validate monitoring username at parse time #47821)
• PROXY_BASE_PATH_SETTING (Validate proxy base path at parse time #47912)
• HEADERS_SETTING (Validate monitoring header overrides at parse time #47848)
• INDEX_NAME_TIME_FORMAT_SETTING (Validate index name time format setting at parse time #47911)
• AUTH_PASSWORD_SETTING (Validate monitoring password at parse time #47740)
• SSL_SETTING (Validate SSL settings at parse time #49196)

This should resolve all of the instances of the problem described in #47038 for settings related to monitoring.

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Settings)

[rjernst]

I think the validation of these should look similar to that in #47246. For example, AUTH_USERNAME_SETTING must be set in conjunction with AUTH_PASSWORD_SETTING, and should be checked with a validator for both settings which cross checks the other is set.

[danhermann]

@rjernst, there is currently a check that AUTH_PASSWORD_SETTING cannot be set without a corresponding AUTH_USERNAME_SETTING but a username can be set without a password. Should I add a new check that prevents that latter scenario?

[rjernst]

Yes, I think both must always be set together? At least the existing check implies that with the error message, and I'm not sure how one could have a username with no password.