Kibana audit logs can be shipped to an OpenTelemetry (OTLP) endpoint

## Summary

PR #280193 refines the transforms the core otel log appender applies to Kibana security audit records based on project-team testing feedback, including promoting resource.attribute values to regular log attributes, and adjusts the audit service wiring. It confirms that shipping Kibana audit logs through the otel appender is an actively maturing 9.6 capability: at HEAD, xpack.security.audit.appender accepts the full core logging appender schema (coreConfig.logging.appenders), which includes the otel type. This specific PR is release_note:skip and changes only the shape of emitted records, but the surrounding feature has a docs discrepancy.

**Why this needs docs:** The PR itself is an internal output-shaping refinement, but it exposes that the audit appender docs list an appender type set that no longer matches the schema once OTel audit logging ships in 9.6.

## Resources

- PR [#280193](https://github.com/elastic/kibana/pull/280193) — [OTel][Audit Log] Changes to OTel Audit Logging from testing feedback

## Availability

| Channel | Details |
|---------|---------|
| **Stack** | v9.6.0 |
| **Serverless** | N/A |
| **Feature flag** | None — active by default |

---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @florent-leborgne*

## Suggested edits

[Security settings in Kibana](https://www.elastic.co/docs/reference/kibana/configuration-reference/security-settings) > Audit logging settings > xpack.security.audit.appender.type
- **What the docs say:** Required. Specifies where audit logs should be written to. Allowed values are console, file, or rolling-file.
- **What to add:** Once OTel audit logging ships, this allowed-values list is factually incomplete: the audit appender schema at HEAD accepts the core logging appenders, including otel, so audit logs can be shipped to an OTLP endpoint. Add otel to the allowed values with a cross-link to the otel appender settings on the Logging settings page (which already documents url, protocol, headers, ssl, and attributes), and scope the addition with an applies_to tag. Confirm with the Kibana Security team whether the capability is GA or preview in 9.6 before publishing. Stack only, from 9.6.0 (not available in serverless).

Start at the Security settings in Kibana documentation for xpack.security.audit.appender.type and compare it with the otel appender settings on the Logging settings page. Confirm the 9.6 GA or preview status with the Kibana Security team, then document otel with the applies_to scope, cross-link, and Stack-only availability described in the issue.

Written by the indexing model from the issue text.