text: Title: Add security tests for es_index built-in action type
  Body: This is the only current built-in that should be sensitive to the user associated with executing an action, in that it performs es calls as part of action execution.