A conditional cluster privilege is like the existing cluster
privilege, except that it has a Predicate over the request as
well as over the action name.
It is the "role descriptor" level representation for the newly
introduced "ConditionalClusterPermission"

This change adds the ConditionalClusterPrivilege interface, and
allows them to be attached to RoleDescriptors, but does not provide
any JSON/XContent support. This means that they cannot be used in the
Roles API, nor are they stored in the security index, but they can be
defined by custom Roles Providers and will be consulted as part of
authorization decisions on Roles.