Heartbeat: Add HashiCorp Vault secret resolution

**Describe the enhancement:**

Add support for resolving HashiCorp Vault secret references in Heartbeat configuration.

This feature would let Heartbeat resolve Vault references at runtime on the Private Location host. Kibana and Elasticsearch would store and receive the reference only, not the plaintext secret.

Use this reference format:

```text
${vault/[@]#}
```

For example:

```text
${vault/production@myapp/credentials#password}
```

The feature could support Vault connection settings delivered through the Elastic Agent policy. An initial
version could support token and AppRole authentication.

Heartbeat would cache resolved secrets in process memory. It should not log, persist, or publish plaintext
secret values.

This request follows the approach in https://github.com/elastic/beats/pull/52368. It supports the Synthetics enhancement request in https://github.com/elastic/kibana/issues/282173.

**Describe a specific use case for the enhancement or feature:**

A customer runs Synthetics monitors from a Private Location. An HTTP monitor needs an API token in its
Authorization header.

Today, the customer stores the token as a Kibana global parameter. This makes the plaintext token available to Kibana and can send it to Elasticsearch. It also complicates the secret management from the customer perspective, as they need to update multiple systems.

With this feature, the customer stores the token in HashiCorp Vault. The monitor configuration contains only a Vault reference:

```yaml
check.request.headers:
Authorization: "Bearer ${vault/production@myapp/credentials#api_token}"
```

Heartbeat resolves the reference on the Private Location host. It sends the token only to the monitored
endpoint. The plaintext token stays in the customer's environment.