management doesn't require SSL connection with elasticsearch

*Original comment by @jsvd:*

setting the following in the config/logstash.yml makes management work without having to set SSL, which I think can be a security concern as the configs (with their passwords) will travel in plain text:

```
xpack.management.enabled: true
xpack.management.elasticsearch.username: elastic
xpack.management.elasticsearch.password: elastic
xpack.management.elasticsearch.url: "http://localhost:9200"
```

while the x-pack logstash should force this, there should be something on the elasticsearch side also rejecting management commands unless they come from a secure connection?

Start with the config/logstash.yml settings and the x-pack Logstash management path named in the issue, then trace how the Elasticsearch URL and credentials are handled. Investigate the proposed Elasticsearch-side rejection of insecure management connections; done means management commands cannot use plain HTTP without a secure-connection failure.

Written by the indexing model from the issue text.