### Description

Currently, when we execute retention policy, we also refresh the destination index by setting:
```
setRefresh(true)
```
on the DBQ request.
This can cause permission errors which are surprising to the user as the permissions are not required when the transform starts:
```
task encountered irrecoverable failure: org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/refresh] is unauthorized for user [found-internal-kibana4-server] with roles [kibana_system,found-internal-kibana4-server] on indices [logs-cloud_security_posture.findings_latest-default], this action is granted by the index privileges [maintenance,manage,all]
```

We still want the user to have the permissions to delete the documents. But we should execute `refresh` as the system user.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/TransformIndexer.java
}
    /**
     * Handle permanent bulk indexing exception case. This is error is irrecoverable.
     *
     * @param bulkIndexingException BulkIndexingException thrown
     */
    private void handleIrrecoverableBulkIndexingException(BulkIndexingException bulkIndexingException) {
        String message = TransformMessages.getMessage(
            TransformMessages.LOG_TRANSFORM_PIVOT_IRRECOVERABLE_BULK_INDEXING_ERROR,
            bulkIndexingException.getDetailedMessage()
        );
        failIndexer(message);
    }
    protected void failIndexer(String failureMessage) {
        
        context.markAsFailed(failureMessage);
    }
    /**
     * Indicates if an audit message should be written when onFinish is called for the given checkpoint
     * We audit the first checkpoint, and then every 10 checkpoints until completedCheckpoint == 99
     * Then we audit every 100, until completedCheckpoint == 999
     *
     * Then we always audit every 1_000 checkpoints
     *
     * @param completedCheckpoint The checkpoint that was just completed
     * @return {@code true} if an audit message should be written
     */
    protected boolean shouldAuditOnFinish(long completedCheckpoint) {
        if (++logCount % logEvery != 0) {
            return false;