[Feature]: Introduce elasticstack_authentication + elasticstack_tls masters with an insecure-auth guard

Foundation for splitting the per-role *_security flags (umbrella #526).

• Add two shared masters: elasticstack_authentication (default true) and elasticstack_tls (default true). Each role's future *_authentication / *_tls takes its default from the matching master via a plain variable default (not set_fact), so a user can override it per role without the master stomping the value.
• Add elasticstack_allow_insecure_auth (default false).
• Add a preflight assert (in the shared elasticstack role): fail when authentication is on and TLS is off, unless elasticstack_allow_insecure_auth is true — otherwise credentials would be sent over the wire in cleartext.

This is only the groundwork (masters + guard); the actual removal of the beats_security / logstash_security / kibana_security flags happens in the child PRs.

Breaking → 2.0.0. Part of #526.

Start by locating the shared elasticstack role and the existing per-role *_security defaults. Trace how shared variables and role defaults are currently defined, then identify the role's preflight entry point for the authentication/TLS assertion. Done means the two masters, the insecure-auth override, and the guard work without overriding per-role values; the issue names no tests to run.