[Feature]: Beats — replace beats_security with beats_tls + beats_authentication

beats_security bundles TLS, authentication and cert creation into one flag — and its {% if beats_security %} … {% else %} even renders plain http:// with no credentials when off. TLS and auth cannot be chosen independently.

• Remove beats_security. Introduce:
  • beats_tls (default from elasticstack_tls) → renders ssl.* (verification_mode, CA, and the client certificate to Logstash).
  • beats_authentication (default from elasticstack_authentication) → renders username / password for the ES output and setup.kibana. Credentials are no longer gated on the TLS flag.
• Drop the beats_security set_fact in tasks/main.yml.
• Rename beats-security.yml → beats_manage_certificates.yml; move the elastic-password fetch out of it (it belongs to the authentication/password axis, not to certificate management).

Breaking → 2.0.0. Part of #526; builds on #513 (shared Beats SSL settings).

Depends on: #527 (the shared masters + guard must exist first).

Start with tasks/main.yml and the existing beats-security.yml, then review the shared Beats SSL settings from #513 and the masters-and-guard work required by #527. Rename the certificate task file, separate TLS from authentication and move the elastic-password fetch to the authentication path. Done means beats_tls and beats_authentication work independently and beats_security is removed for the 2.0.0 breaking change.