[FEATURE] migrate DLS variable substitution away from text-based substitution

[rursprung]

Is your feature request related to a problem?
the current implementation of variable substitution for DLS is entirely text-based:

security/src/main/java/org/opensearch/security/privileges/UserAttributes.java

Lines 59 to 61 in 28cc929

	final var stringSubstitutor = new StringSubstitutor(replacements).setEnableSubstitutionInVariables(true);
	orig = stringSubstitutor.replace(orig);
	return orig;

this means that an attacker who can control one of the values ending up in there can alter the query as desired.
the risk of this is low as all values available for substitution come from trusted environments (authentication/authorization systems).

What solution would you like?
move away from string-based substitution. instead work directly on the JSON tree of the query.
this will probably have to be a new feature available in parallel to the existing one to allow time for migration as it's unlikely that the query definition with placeholders will still look the same.

What alternatives have you considered?
n/a

Do you have any additional context?
#6310 introduces a feature which we consider unsafe for now due to this string substitution (though it does have some safety measures built in)