[Feature]: Logstash — replace logstash_security with logstash_tls + logstash_authentication

logstash_security bundles TLS, the ES-output user/password, certificate creation and ES role/user creation into one flag.

• Remove logstash_security. Introduce:
  • logstash_tls (default from elasticstack_tls) → keystore / cacert / ssl => true in the ES output.
  • logstash_authentication (default from elasticstack_authentication) → user / password in the ES output.
• Drop the logstash_security set_fact in tasks/main.yml.
• Split logstash-security.yml → logstash_manage_certificates.yml + logstash_manage_users.yml.
• Rebuild the ES-output block (elasticsearch-output.conf.j2:34-41) into three independent conditions: TLS ← logstash_tls, auth ← logstash_authentication, host resolution ← the residual full_stack / standalone (user-provided CA).

Breaking → 2.0.0. Part of #526.

Depends on: #527 (the shared masters + guard must exist first).

First review the shared masters and guard from #527, then inspect tasks/main.yml, logstash-security.yml, logstash_manage_certificates.yml, logstash_manage_users.yml, and elasticsearch-output.conf.j2. Done means logstash_security and its set_fact are removed, TLS, authentication, and host resolution use independent conditions, and the certificate and user management responsibilities are split for the 2.0.0 breaking change.