xpack management certificate works with RSA PKCS#8 - request for EC PKCS#8 support

[doc](https://github.com/elastic/logstash/blob/ab859c28ac21ede24cd999e9bd98c0a372d12a3c/docs/reference/configuring-centralized-pipelines.md?plain=1#L115-L128) currently mentions :
```
`xpack.management.elasticsearch.ssl.certificate`
: Optional setting that provides the path to an SSL certificate to use to authenticate the client. This certificate should be an OpenSSL-style X.509 certificate file.

`xpack.management.elasticsearch.ssl.key`
: Optional setting that provides the path to an OpenSSL-style RSA private key that corresponds to the `xpack.management.elasticsearch.ssl.certificate`.
```

Using [elasticsearch 9.4.4 certutil](https://www.elastic.co/docs/reference/elasticsearch/command-line-tools/certutil) which uses RSA PKCS#1 fails with :
```
[2026-08-05T16:03:12,474][ERROR][logstash.licensechecker.licensereader] Unable to retrieve Elasticsearch cluster info. {message: "java.security.InvalidKeyException: Unable to decode key", exception: Java::JavaSecuritySpec::InvalidKeySpecException}
```

`RSA PKCS#8` works fine so potentially documentation should specify `RSA PKCS#8` instead of `RSA` - to match what [manticore](https://github.com/cheald/manticore/blob/aa692fb77eec2a7aad7362d0ca5d87b8fb36fd5d/lib/manticore/client.rb#L754) expects and make it clear RSA PKCS#1 is not supported

User reported and reproduced that `EC PKCS#8` fails with `Invalid RSA private key` (reproducible) - workaround in https://discuss.elastic.co/t/ls-to-es-via-mtls-rsa-only/374849/2 :
```
sed -i -e 's/BEGIN PRIVATE/BEGIN EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key
sed -i -e 's/END PRIVATE/END EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key
```

## reproduction

[944cpm-xpackmanagement-rsapkcs8.zip](https://github.com/user-attachments/files/30753380/944cpm-xpackmanagement-rsapkcs8.zip)

Example requires docker-compose (with docker having enough RAM assigned to run stack)

To reproduce :
- execute `./runAll.sh` this will start ES+Kibana+Logstash+metricbeat (monitoring) with centralized pipeline management using PKCS#8 which is working ok
- in docker-compose.yml comment 2 lines key/certificate and uncomment another to reproduce issue with RSA PKCS#1 or EC PKCS8 in volume for `logstash0`:
```
volumes:
- ./config/logstash0.yml:/usr/share/logstash/config/logstash.yml
- ./certs/ca/ca.crt:/usr/share/logstash/config/ca.crt
# - ./certs/logstash0/logstash0.crt:/usr/share/logstash/config/logstash0.crt
# - ./certs/logstash0/logstash0.key:/usr/share/logstash/config/logstash0.key #Unable to decode key (certutil generate RSA PKCS#1)

# - ./certs/logstash0-RSA2048b/logstash0.crt:/usr/share/logstash/config/logstash0.crt
# - ./certs/logstash0-RSA2048b/logstash0.key:/usr/share/logstash/config/logstash0.key # java.security.InvalidKeyException: Unable to decode key

- ./certs/logstash0-rsapkcs8/logstash0.crt:/usr/share/logstash/config/logstash0.crt #works
- ./certs/logstash0-rsapkcs8/logstash0.key:/usr/share/logstash/config/logstash0.key #works

# - ./certs/logstash0-ECPKCS1/logstash0.crt:/usr/share/logstash/config/logstash0.crt
# - ./certs/logstash0-ECPKCS1/logstash0.key:/usr/share/logstash/config/logstash0.key # java.security.InvalidKeyException: Unable to decode key

# - ./certs/logstash0-ECPKCS8/logstash0.crt:/usr/share/logstash/config/logstash0.crt
# - ./certs/logstash0-ECPKCS8/logstash0.key:/usr/share/logstash/config/logstash0.key # java.security.InvalidKeyException: Invalid RSA private key

# - ./certs/logstash0-ECPKCS8-edited/logstash0.crt:/usr/share/logstash/config/logstash0.crt
# - ./certs/logstash0-ECPKCS8-edited/logstash0.key:/usr/share/logstash/config/logstash0.key #works adding EC in header/footer of key
```

After each change run `docker-compose up logstash` - this will recreate the container because service definition changed and display the log (or `docker-compose up -d logstash0 && docker-compose logs -f logstash0`)

`ECPKCS8-edited` is a copy of `ECPKCS8` where the grep workaround was applied

Start with docs/reference/configuring-centralized-pipelines.md and the reproduction's docker-compose.yml and runAll.sh. Run the supplied RSA PKCS#1, RSA PKCS#8, and EC PKCS#8 configurations to confirm the reported failures, then trace the certificate-key handling exposed by the Logstash management connection. Done means the intended key formats are supported or clearly documented, with the reproduction cases passing as applicable.

Written by the indexing model from the issue text.