Restrict cross-cluster API keys to a TLS certificate in Kibana

## Summary

Kibana can now create and update cross-cluster API keys with a certificate identity for strong identity verification. In the API key flyout, users enable **Add strong identity verification** and enter a Distinguished Name pattern; the key details view can reveal and copy the stored identity. Disabling the option while updating a key clears an existing certificate identity.

**Why this needs docs:** The API-key UI gains a security-sensitive optional workflow that the existing create and update instructions do not mention.

## Resources

- PR [#275610](https://github.com/elastic/kibana/pull/275610) — Security: add certificate identity field to cross-cluster API keys
- Product issue: https://github.com/elastic/kibana/issues/276046

Screenshots from PR


## Availability

| Channel | Details |
|---------|---------|
| **Stack** | v9.6.0 |
| **Serverless** | N/A |
| **Feature flag** | None — active by default |

---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @florent-leborgne*

## Suggested edits

[Elasticsearch API keys](https://www.elastic.co/docs/deploy-manage/api-keys/elasticsearch-api-keys) > Create an API key and Update an API key
- **What the docs say:** The create workflow covers expiry, access, and metadata; the update workflow lists indices and metadata for cross-cluster keys.
- **What to add:** Add the optional **Add strong identity verification** step for cross-cluster keys, explain that **Certificate identity string** accepts a certificate Distinguished Name pattern, and document viewing, copying, changing, or clearing the value. Link to the remote-cluster strong identity verification procedure, and preserve the earlier workflow with section-level version scoping. Stack only, from 9.6.0 (not available in serverless).

[Add remote clusters using API key authentication](https://www.elastic.co/docs/deploy-manage/remote-clusters/remote-clusters-api-key) > Configure strong identity verification > On the remote cluster
- **What the docs say:** The procedure tells users to create the cross-cluster API key with the API and set `certificate_identity`.
- **What to add:** Add Kibana as an alternative for creating the cross-cluster API key and link to the API key management workflow, while retaining the API example and the Distinguished Name pattern guidance. Stack only, from 9.6.0 (not available in serverless).