[Feature]: Generate the Kibana browser (server.ssl) certificate from the stack CA by default

Describe the feature request

When kibana_tls: true, the role points server.ssl.certificate/key at
cert.pem/key.pem, but never generates them, so browser TLS only works if the
user brings their own certificate. Meanwhile the role generates
<hostname>-kibana.p12 (stack-CA signed) and copies it to /etc/kibana/certs/,
but nothing uses it.

Wanted: generate the browser certificate from the stack CA by default (so
kibana_tls works out of the box, like every other endpoint in the collection),
while keeping the option to bring your own via kibana_tls_cert/kibana_tls_key.

Scope: only the Kibana server/browser certificate (server.ssl). The
Kibana ↔ Elasticsearch side is separate (#486, 1.2.0).

Start by tracing the role logic behind kibana_tls and the existing -kibana.p12 copy to /etc/kibana/certs/. Verify the server.ssl certificate/key paths and the kibana_tls_cert/kibana_tls_key override path; done means default browser TLS uses a stack-CA certificate while bring-your-own certificates and the separate Elasticsearch connection scope remain unchanged.