Remaining infosec findings from 27626

Follow-up to the review in https://github.com/elastic/infosec/issues/27626.

Closed findings stay there. These four are still open, all medium:

- https://github.com/elastic/cli/issues/509 ECLI-003: Buildkite bootstraps executable tools without repository-controlled integrity verification
- https://github.com/elastic/cli/issues/512 ECLI-006: All extensions receive every configured Elastic credential
- https://github.com/elastic/cli/issues/518 ECLI-012: Privileged workflows execute branch-controlled npm lifecycle code
- https://github.com/elastic/cli/issues/520 ECLI-014: Buildkite PR builds may execute branch-controlled code on a Vault-capable agent