### Description

Currently, when we execute retention policy, we also refresh the destination index by setting:
```
setRefresh(true)
```
on the DBQ request.
This can cause permission errors which are surprising to the user as the permissions are not required when the transform starts:
```
task encountered irrecoverable failure: org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/refresh] is unauthorized for user [found-internal-kibana4-server] with roles [kibana_system,found-internal-kibana4-server] on indices [logs-cloud_security_posture.findings_latest-default], this action is granted by the index privileges [maintenance,manage,all]
```

We still want the user to have the permissions to delete the documents. But we should execute `refresh` as the system user.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/TransformIndexer.java
if (transformConfig.equals(config) && fieldMappings != null) {
                        logger.trace("[{}] transform config has not changed.", getJobId());
                        configurationReadyListener.onResponse(null);
                    } else {
                        transformConfig = config;
                        logger.debug("[{}] successfully refreshed transform config from index.", getJobId());
                        reLoadFieldMappingsListener.onResponse(null);
                    }
                }, failure -> {
                    String msg = TransformMessages.getMessage(TransformMessages.FAILED_TO_RELOAD_TRANSFORM_CONFIGURATION, getJobId());
                    logger.error(msg, failure);
                    
                    
                    if (failure instanceof ResourceNotFoundException) {
                        reLoadFieldMappingsListener.onFailure(new TransformConfigLostOnReloadException(msg, failure));
                    } else {
                        auditor.warning(getJobId(), msg);
                        reLoadFieldMappingsListener.onResponse(null);
                    }
                }));
            } else {
                reLoadFieldMappingsListener.onResponse(null);
            }
        }, listener::onFailure);
        Instant instantOfTrigger = Instant.ofEpochMilli(now);
        
        
        if (context.getCheckpoint() > 0 && initialRun()) {
            sourceHasChanged(ActionListener.wrap(hasChanged -> {
                context.setLastSearchTime(instantOfTrigger);