Both Security and Reporting plugins use addSystemApiHeader and isSystemApiRequest methods exposed by the Kibana legacy plugin. And we have to use various workarounds to access these methods from the new platform plugins.

It feels like something that belongs to platform, but not sure how exactly it should be represented there.

cc @restrry @kobelb