Description of problem:

As an RHDH security/devops engineer, I want to ensure views from the Lightspeed plugin are RBAC'd and free of important/high severity security findings, so I can limit the exposure of information to only those on a need to know basis.

This applies to both front end and backend.

More context: RHIDP-1531 

Acceptance criteria: 

• Should have the permission support UI
• External plugin services cannot read each others' PII and/or confidential information
• Customer documentation updated with instructions on how to configure RBAC and logging

Additional info:

Fix approach:

• Review RHDH SCA and other scanners' findings that affect your plugin
• Implement RBAC using these resources:
  • Enforce the Principle of Least Privilege
  • Maintain a Data Map
  • Perform Auth checks on REST API
• Update tests to create appropriate RBAC
• If applicable, implement audit logging 
• Update shared procedures with instructions on how to create role/binding and enable logging