[Umbrella]: Decompose the overloaded elasticstack_full_stack variable

elasticstack_full_stack is one boolean doing several unrelated jobs, so the name no longer says what it does. Today it gates, all at once:

• (A) package-repo strategy — the enablerepo: elastic-* on RedHat installs;
• (B) inventory host wiring — Kibana/Beats/Logstash resolving Elasticsearch (and each other) from inventory groups;
• (C) security provisioning — whether the collection acts as CA (generates/distributes certs) and generates/fetches the built-in passwords;
• (D) a cross-host handler — restarting Kibana after an Elasticsearch certificate change.

Goal: peel each meaning into its own clearly-named variable, leaving full_stack with only (B) — then rename it (no alias). Each resulting flag is independent and defaults to true, so default behaviour is unchanged; a standalone user turns off only what they don't want.

Children (one PR each):

• #507 — (A) remove the forced enablerepo from all install tasks (+ rolling-upgrade) · 1.0.0
• #532 — (C1) elasticstack_manage_ca
• #533 — (C2) elasticstack_generate_passwords
• #534 — (D) fix the Kibana-restart-on-ES-cert handler + drop its full_stack gate · 1.0.0
• #535 — (B) rename elasticstack_full_stack (residual = inventory wiring), no alias

Breaking → 2.0.0. Migration documented (full_stack → the new flags). Related: #446 (EL7 removal simplifies the security branching this touches).

Start with child issues #507 and #532–#535, which divide the overloaded variable's package-repository, security, handler, and inventory-wiring responsibilities. Review the migration requirement in this issue and the related #446 context. Done means each responsibility has an independent flag defaulting to true, the residual inventory flag is renamed without an alias, and the breaking migration is documented.