Saved object update w/ upsert doesn't work for multi-namespace objects that don't exist

[jportner]

Kibana version: 7.14+

Describe the bug:

I uncovered this while troubleshooting some bugs in #114620. That PR changes the visualization saved object to use namespaceType: 'multiple-isolated' (to become share-capable). In the process, an API integration test started failing:

kibana/test/api_integration/apis/saved_objects/update.ts

Lines 105 to 117 in 7917e3c

	it('handles upsert', async () => {
	await supertest
	.put(`/api/saved_objects/visualization/upserted-viz`)
	.send({
	attributes: {
	title: 'foo',
	},
	upsert: {
	title: 'upserted title',
	description: 'upserted description',
	},
	})
	.expect(200);

This first assertion failed with a 404 error. Digging into it, I realized that it's because the upsert handling in the SavedObjectsRepository (SOR) is flawed:

kibana/src/core/server/saved_objects/service/lib/repository.ts

Lines 1211 to 1240 in d822d6d

	let preflightResult: SavedObjectsRawDoc | undefined;
	if (this._registry.isMultiNamespace(type)) {
	preflightResult = await this.preflightCheckIncludesNamespace(type, id, namespace);
	}
	const time = getCurrentTime();
	let rawUpsert: SavedObjectsRawDoc | undefined;
	if (upsert) {
	let savedObjectNamespace: string | undefined;
	let savedObjectNamespaces: string[] | undefined;
	if (this._registry.isSingleNamespace(type) && namespace) {
	savedObjectNamespace = namespace;
	} else if (this._registry.isMultiNamespace(type)) {
	savedObjectNamespaces = await this.preflightGetNamespaces(type, id, namespace);
	}
	const migrated = this._migrator.migrateDocument({
	id,
	type,
	...(savedObjectNamespace && { namespace: savedObjectNamespace }),
	...(savedObjectNamespaces && { namespaces: savedObjectNamespaces }),
	attributes: {
	...upsert,
	},
	updated_at: time,
	});
	rawUpsert = this._serializer.savedObjectToRaw(migrated as SavedObjectSanitizedDoc);
	}

Usage of the preflightCheckIncludesNamespace method was added before the upsert functionality. That will throw a 404 error if the object doesn't exist in the current space. So if you try to use upsert for an object that doesn't exist, it will always fail with a 404 error.

Steps to reproduce:

Use #114620 and observe the failing integration test.

Expected behavior:

If upsert is NOT used:

1. Updating an object when it exists in the current space should succeed
2. Updating an object when it exists, but not in the current space, should fail with a 404
3. Updating an object when it doesn't exist should fail with a 404

If upsert IS used:

1. Updating an object when it exists in the current space should succeed
2. Updating an object when it exists, but not in the current space, should fail with a 404
3. Updating an object when it doesn't exist should succeed

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)