Confirm correct API access for v9

[kpatticha]

API route access is changing in V9.

• A route must be tagged with access:{valid_access_string} to specify its intended access
• Any route that isn't tagged with the access: tag will be PRIVATE by default

Acceptance criteria

• We need to confirm that our APIs have the intended access configuration
• Make adjustments if needed (APM has some public APIs)

example work: https://github.com/elastic/kibana/pull/186882/files

[elasticmachine]

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)