_FILE variable permission check does not follow symlinks

[pebrc]

Elasticsearch version (bin/elasticsearch --version): 7.6.0-SNAPSHOT / 8.0.0-SNAPSHOT

Plugins installed: []

JVM version (java -version): official Docker image

OS version (uname -a if on a Unix-like system): official Docker image

Description of the problem including expected versus actual behavior:
#49182 introduces support for environment variables ending in _FILE to point to a file that will be read to create the value of an environment variable of the name minus the _FILE suffix. The startup script imposes strict permission checks on these files and requires them to have either 0400 or 0600 permissions.

On Kubernetes these sensitive files are typically mounted as so called Secrets into the docker container. That introduces an additional level of indirection with a symlink that has 0777 file permissions and therefore fails the checks in the Elasticsearch startup script.

The expected behaviour would be to check the permissions on the effective file after following symlinks instead.

Example shell session on an ECK managed Elasticsearch container to illustrate the problem:

[root@cluster1-es-default-0 elasticsearch]# ls -l /mnt/elastic-internal/probe-user/
total 0
lrwxrwxrwx 1 root root 29 Nov 27 15:55 elastic-internal-probe -> ..data/elastic-internal-probe
[root@cluster1-es-default-0 elasticsearch]# ls -l /mnt/elastic-internal/probe-user/..data/elastic-internal-probe 
-rw------- 1 root root 24 Nov 27 15:55 /mnt/elastic-internal/probe-user/..data/elastic-internal-probe

where /mnt/elastic-internal/proble-user is a volume mount of a k8s volume with the following definition:

  - name: elastic-internal-probe-user
    secret:
      defaultMode: 384
      items:
      - key: elastic-internal-probe
        path: elastic-internal-probe
      optional: false
      secretName: cluster1-es-internal-users

Note: defaultMode are the file permissions base 10 ie. 384 == 0600

Steps to reproduce:
Run Elasticsearch 7.6.0-SNAPSHOT on k8s with an environment variable ending in _FILE and a corresponding file mounted into the pod. Probably the easiest way to achieve that is to
run Elasticsearch on ECK 1.0.0-beta1 with this manifest:

apiVersion: elasticsearch.k8s.elastic.co/v1beta1                                                                                                                                                                      
kind: Elasticsearch                                                                                                                                                                                                   
metadata:                                                                                                                                                                                                             
  name: cluster1                                                                                                                                                                                                      
spec:                                                                                                                                                                                                                 
  image: my.private.docker/registry/elasticsearch:7.6.0-SNAPSHOT                                                                                                                                                              
  version: 7.6.0                                                                                                                                                                                                      
  nodeSets:                                                                                                                                                                                                           
  - count: 1                                                                                                                                                                                                          
    name: default                                                                                                                                                                                                     
    config:                                                                                                                                                                                                           
      node.store.allow_mmap: false 

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Packaging)