Provide document-level access control for APM data

Currently, the only way to control access to APM data at the document level is to add certain properties to all documents stored in elasticsearch which also includes span documents. Even though spans support tags, we have so far decided against adding global tags to spans (e.g. https://github.com/elastic/apm-server/issues/2037). The main concern for us is the storage cost of adding tags to all spans. However, it is reasonable to expect some form of document-level access control for APM data and there are already [feature requests from our users](https://discuss.elastic.co/t/custom-field-tag-label-whatever-available-in-transaction-and-subsequent-spans-without-defining-them/185775/2).

This issue is for discussing the possible solutions and action items.

cc @roncohen @axw @elastic/apm-agent-devs