[Feature]: Kibana — remove kibana_security (ES connection follows Elasticsearch; keep kibana_tls)

[afeefghannam89]

Unlike Beats/Logstash, Kibana's Elasticsearch connection has no independent auth/TLS choice — it is dictated by Elasticsearch, so Kibana does not get the *_authentication / *_tls split.

Background (why):

• Kibana has no separate xpack.security.enabled in 8.x; it follows Elasticsearch — "you do not need to disable security features in those kibana.yml files" (Configure security in Kibana).
• Kibana→ES authentication is therefore ES-dictated: xpack.security.enabled "must be enabled to use Elasticsearch's authentication, authorization and audit features" and is mandatory in 8 (Security settings). When ES security is on, Kibana must send its kibana_system credentials — it cannot connect anonymously. A kibana_authentication flag would be meaningless.
• Kibana→ES TLS follows elasticsearch_http_security (Kibana must match ES's http/https) — not a Kibana-owned switch.
• Kibana's only genuinely own switch is kibana_tls (the browser-facing server.ssl).

Change:

• Remove kibana_security. The ES-connection block (https + CA + kibana_system credentials) renders whenever Kibana talks to a secured ES (i.e. it follows Elasticsearch), with the http/https scheme following elasticsearch_http_security.
• Keep kibana_tls unchanged (server side).
• Rename kibana-security.yml → kibana_manage_certificates.yml; move the kibana_system-password fetch out.
• The insecure combo (ES security on + elasticsearch_http_security: false → kibana_system credentials over http) is covered by the collection-wide elasticstack_allow_insecure_auth guard (see [Umbrella]: Separate authentication from TLS across Beats, Logstash and Kibana #526).

Breaking → 2.0.0. Part of #526.

Depends on: #527 (the shared masters + guard must exist first).