Part of https://github.com/elastic/kibana/issues/154715

The `.fleet-secrets` system index should just have a value key. 

Kibana system should only have write and delete access NOT read access.

Fleet server will have read access only. 

Example document:

```
// example document from the .fleet-secrets index 
{
	_id: 'abcd1234'
	_source: {
	   value: "abcd12345678",
      }
}
```
 
x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
.setting("xpack.security.http.ssl.certificate_authorities", "ca.crt")
        .setting("xpack.security.transport.ssl.enabled", "true")
        .setting("xpack.security.transport.ssl.certificate", "node.crt")
        .setting("xpack.security.transport.ssl.key", "node.key")
        .setting("xpack.security.transport.ssl.certificate_authorities", "ca.crt")
        .setting("xpack.security.transport.ssl.verification_mode", "certificate")
        .keystore("bootstrap.password", "x-pack-test-password")
        .keystore("xpack.security.transport.ssl.secure_key_passphrase", "node-password")
        .keystore("xpack.security.http.ssl.secure_key_passphrase", "node-password")
        .configFile("node.key", Resource.fromClasspath("ssl/node.key"))
        .configFile("node.crt", Resource.fromClasspath("ssl/node.crt"))
        .configFile("ca.crt", Resource.fromClasspath("ssl/ca.crt"))
        .configFile("service_tokens", Resource.fromClasspath("service_tokens"))
        .rolesFile(Resource.fromClasspath("roles.yml"))
        .user("test_admin", "x-pack-test-password")
        .user("elastic/fleet-server", "x-pack-test-password", "superuser")
        .user("service_account_manager", "x-pack-test-password", "service_account_manager")
        .build();
    @BeforeClass
    public static void init() throws URISyntaxException, FileNotFoundException {
        URL resource = ServiceAccountIT.class.getResource("/ssl/ca.crt");
        if (resource == null) {
            throw new FileNotFoundException("Cannot find classpath resource /ssl/ca.crt");
        }
        caPath = PathUtils.get(resource.toURI());
    }
    @Override
    protected String getTestRestCluster() {
        return cluster.getHttpAddresses();
    }