[Fleet] Support force flag in bulk upgrade agents API (#94952)

## Summary

0cbbb41da2 is just a rearrangement of the tests.  5cad301e87 has the real changes: 
* Bug fix: `force: true` should bypass any restrictions re: managed policies
* Refactoring towards new response shape coming as part of https://github.com/elastic/kibana/issues/90437
* Added test to confirm new behavior


### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

x-pack/plugins/fleet/server/routes/agent/upgrade_handler.ts

@@ -92,21 +92,14 @@ export const postBulkAgentsUpgradeHandler: RequestHandler<
   }
 
   try {
-    if (Array.isArray(agents)) {
-      await AgentService.sendUpgradeAgentsActions(soClient, esClient, {
-        agentIds: agents,
-        sourceUri,
-        version,
-        force,
-      });
-    } else {
-      await AgentService.sendUpgradeAgentsActions(soClient, esClient, {
-        kuery: agents,
-        sourceUri,
-        version,
-        force,
-      });
-    }
+    const agentOptions = Array.isArray(agents) ? { agentIds: agents } : { kuery: agents };
+    const upgradeOptions = {
+      ...agentOptions,
+      sourceUri,
+      version,
+      force,
+    };
+    await AgentService.sendUpgradeAgentsActions(soClient, esClient, upgradeOptions);
 
     const body: PostBulkAgentUpgradeResponse = {};
     return response.ok({ body });

x-pack/plugins/fleet/server/services/agents/upgrade.ts

@@ -83,32 +83,33 @@ export async function sendUpgradeAgentsActions(
     force?: boolean;
   }
 ) {
+  // Full set of agents
+  const agentsGiven = await getAgents(esClient, options);
+
+  // Filter out agents currently unenrolling, unenrolled, or not upgradeable b/c of version check
   const kibanaVersion = appContextService.getKibanaVersion();
-  // Filter out agents currently unenrolling, agents unenrolled, and agents not upgradeable
-  const agents = await getAgents(esClient, options);
-
-  // upgradeable if they pass the version check
   const upgradeableAgents = options.force
-    ? agents
-    : agents.filter((agent) => isAgentUpgradeable(agent, kibanaVersion));
+    ? agentsGiven
+    : agentsGiven.filter((agent) => isAgentUpgradeable(agent, kibanaVersion));
 
-  // get any policy ids from upgradable agents
-  const policyIdsToGet = new Set(
-    upgradeableAgents.filter((agent) => agent.policy_id).map((agent) => agent.policy_id!)
-  );
+  if (!options.force) {
+    // get any policy ids from upgradable agents
+    const policyIdsToGet = new Set(
+      upgradeableAgents.filter((agent) => agent.policy_id).map((agent) => agent.policy_id!)
+    );
 
-  // get the agent policies for those ids
-  const agentPolicies = await agentPolicyService.getByIDs(soClient, Array.from(policyIdsToGet), {
-    fields: ['is_managed'],
-  });
+    // get the agent policies for those ids
+    const agentPolicies = await agentPolicyService.getByIDs(soClient, Array.from(policyIdsToGet), {
+      fields: ['is_managed'],
+    });
 
-  // throw if any of those agent policies are managed
-  for (const policy of agentPolicies) {
-    if (policy.is_managed) {
-      throw new IngestManagerError(`Cannot upgrade agent in managed policy ${policy.id}`);
+    // throw if any of those agent policies are managed
+    for (const policy of agentPolicies) {
+      if (policy.is_managed) {
+        throw new IngestManagerError(`Cannot upgrade agent in managed policy ${policy.id}`);
+      }
     }
   }
-
   // Create upgrade action for each agent
   const now = new Date().toISOString();
   const data = {