### Elasticsearch Version

8.3.3

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

18.04.1-Ubuntu SMP (Running on elastic cloud)

### Problem Description

I want to limit the possible email-recipients for watcher actions using `xpack.notification.email.account.domain_allowlist` 

> Specifies domains to which emails are allowed to be sent. Emails with recipients (To:, Cc:, or Bcc:) outside of these domains will be rejected and an error thrown. This setting defaults to ["*"] which means all domains are allowed. Simple globbing is supported, such as *.company.com in the list of allowed domains. 

[Docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html)

However, the setting doesn't seem to stop emails from being sent. Watcher emails using not-allowed email recipients are still being sent.

EDIT: It seems related to the settings API. The settings works when it is put into `elasticsearch.yml`

### Steps to Reproduce

Configure the allowlist:
```
PUT _cluster/settings
{
  "persistent": {
    "xpack.notification.email.account.domain_allowlist": ["allowed.domain"]
  }
}
```
EDIT: This seems to be the problem. The settings works when it is put into `elasticsearch.yml`.

Then I'm using Kibana to configure a watcher that sends an email to some other domain. For example:
```
"actions": {
  "email_1": {
    "email": {
      "profile": "standard",
      "to": [
        "some@test.com"
      ],
      "body": {
        "text": "nt"
      },
      "subject": "Watch [{{ctx.metadata.name}}] has exceeded the threshold"
    }
  }
},
```

There is also a default email account configured:
```
GET _cluster/settings:
[..]
    "xpack": {
      "notification": {
        "email": {
          "account": {
            "work": {
              "email_defaults": {
                "from": "noreply@alerts.elastic.co"
              },
              "smtp": {
                "host": "containerhost",
                "port": "10025"
              }
            },
            "domain_allowlist": ["allowed.domain"]
          },
          "default_account": "work"
        }
```
Sidenote here: It was necessary to configure `"default_account": "work"` since otherwise Elasticsearch was trying to use `domain_allowlist` as an email account. So that could also indicate some kind of config problem.

### Logs (if relevant)

_No response_
x-pack/plugin/watcher/src/test/java/org/elasticsearch/xpack/watcher/notification/email/EmailServiceTests.java
return account;
            }
        };
    }
    public void testSend() throws Exception {
        when(account.name()).thenReturn("account1");
        Email email = mock(Email.class);
        Authentication auth = new Authentication("user", new Secret("passwd".toCharArray()));
        Profile profile = randomFrom(Profile.values());
        when(account.send(email, auth, profile)).thenReturn(email);
        EmailService.EmailSent sent = service.send(email, auth, profile, "account1");
        verify(account).send(email, auth, profile);
        assertThat(sent, notNullValue());
        assertThat(sent.email(), sameInstance(email));
        assertThat(sent.account(), is("account1"));
    }
    public void testAccountSmtpPropertyConfiguration() {
        Settings settings = Settings.builder()
            .put("xpack.notification.email.account.account1.smtp.host", "localhost")
            .put("xpack.notification.email.account.account1.smtp.starttls.required", "true")
            .put("xpack.notification.email.account.account2.smtp.host", "localhost")
            .put("xpack.notification.email.account.account2.smtp.connection_timeout", "1m")
            .put("xpack.notification.email.account.account2.smtp.timeout", "1m")
            .put("xpack.notification.email.account.account2.smtp.write_timeout", "1m")
            .put("xpack.notification.email.account.account3.smtp.host", "localhost")
            .put("xpack.notification.email.account.account3.smtp.send_partial", true)
            .put("xpack.notification.email.account.account4.smtp.host", "localhost")
            .put("xpack.notification.email.account.account4.smtp.local_address", "localhost")
            .put("xpack.notification.email.account.account4.smtp.local_port", "1025")
            .put("xpack.notification.email.account.account5.smtp.host", "localhost")