[Feature]: Allow bringing your own certificates for Elasticsearch

Describe the feature request

Current state

The elasticsearch role always uses certificates generated by elasticsearch-certutil.
elasticsearch.yml hardcodes the per-node p12 for both layers
(xpack.security.transport.ssl.* and xpack.security.http.ssl.* →
certs/<host>.p12). There are no variables to use your own certificates or a
corporate/public CA.

Elasticsearch supports it

Using elasticsearch-certutil is not required — Elasticsearch accepts PEM
(certificate/key/certificate_authorities) or a keystore for both the transport
and HTTP layers. The beats role already exposes this via beats_tls_*; elasticsearch
does not.

Goal

Add variables so users can supply their own certificates / CA for Elasticsearch
(HTTP and transport layers) instead of the certutil-generated ones. All nodes must
share the same CA.

Safe defaults (non-breaking)

Default keeps today's certutil behaviour; the new options are additive.

Inspect the Elasticsearch role's elasticsearch.yml template and compare its certificate handling with the Beats role variables named beats_tls_*. Trace the role defaults and templates to see where transport and HTTP TLS settings are generated. Done means users can provide PEM or keystore certificates and a shared CA for both layers, while the existing certutil behavior remains the default.