Currently if the user executing the create and follow api has manager_ccr cluster privilege then it is allowed the create a follow index even if the user does not have the create_index index privilege. This unexpected as creating an index is seen as an index level privilege.

Instead we should introduce a create_follow_index index privilege that the user will need to have in order for the create and follow api to create the follow index.