### Description

Currently, when we execute retention policy, we also refresh the destination index by setting:
```
setRefresh(true)
```
on the DBQ request.
This can cause permission errors which are surprising to the user as the permissions are not required when the transform starts:
```
task encountered irrecoverable failure: org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/refresh] is unauthorized for user [found-internal-kibana4-server] with roles [kibana_system,found-internal-kibana4-server] on indices [logs-cloud_security_posture.findings_latest-default], this action is granted by the index privileges [maintenance,manage,all]
```

We still want the user to have the permissions to delete the documents. But we should execute `refresh` as the system user.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/TransformIndexer.java
long checkpointLowerBound = context.getCheckpoint() - NUMBER_OF_CHECKPOINTS_TO_KEEP;
        long lowerBoundEpochMs = now - RETENTION_OF_CHECKPOINTS_MS;
        if (checkpointLowerBound > 0 && lowerBoundEpochMs > 0) {
            transformsConfigManager.deleteOldCheckpoints(
                transformConfig.getId(),
                checkpointLowerBound,
                lowerBoundEpochMs,
                ActionListener.wrap(deletes -> {
                    logger.debug("[{}] deleted [{}] outdated checkpoints", getJobId(), deletes);
                    listener.onResponse(null);
                    lastCheckpointCleanup = context.getCheckpoint();
                }, e -> {
                    logger.warn(() -> "[" + getJobId() + "] failed to cleanup old checkpoints, retrying after next checkpoint", e);
                    auditor.warning(
                        getJobId(),
                        "Failed to cleanup old checkpoints, retrying after next checkpoint. Exception: " + e.getMessage()
                    );
                    listener.onResponse(null);
                })
            );
        } else {
            logger.debug("[{}] checked for outdated checkpoints", getJobId());
            listener.onResponse(null);
        }
    }
    private void sourceHasChanged(ActionListener<Boolean> hasChangedListener) {
        checkpointProvider.sourceHasChanged(getLastCheckpoint(), ActionListener.wrap(hasChanged -> {
            logger.trace("[{}] change detected [{}].", getJobId(), hasChanged);
            hasChangedListener.onResponse(hasChanged);
        }, e -> {