Make owner/group consistent in the elasticsearch role

The elasticsearch role mostly follows the package's ownership model — config and certificates are root-owned and readable through the elasticsearch group, data/logs belong to the service user — but two things are inconsistent.

1. elasticsearch_group is pointless and unsafe.
It is used only in the three jvm.options.d tasks (owner root, mode 0660) and defaults to elasticsearch. The package fixes the service to User=elasticsearch / Group=elasticsearch, so any other value makes those files unreadable for the service. Replace {{ elasticsearch_group }} with the literal elasticsearch and drop the variable. (The paired elasticsearch_user was already removed as dead.)

2. elasticsearch.yml breaks the pattern.
It is written root:root mode 0644 (world-readable), while every other config file is root:elasticsearch group-readable. Align it to root:elasticsearch mode 0640.

Note: the fix is not to chown config/certs to the service user — they must stay root-owned and group-readable so the service cannot rewrite its own config. Dropping elasticsearch_group is a minor breaking change.

Relates to #84.

In the elasticsearch role, locate the three jvm.options.d tasks and the elasticsearch.yml task or template. Replace the variable group with elasticsearch, remove elasticsearch_group, and make elasticsearch.yml root-owned with group elasticsearch and mode 0640; verify the role tests or rendered task settings cover these ownership and mode changes.