Part of https://github.com/elastic/kibana/issues/154715

The `.fleet-secrets` system index should just have a value key. 

Kibana system should only have write and delete access NOT read access.

Fleet server will have read access only. 

Example document:

```
// example document from the .fleet-secrets index 
{
	_id: 'abcd1234'
	_source: {
	   value: "abcd12345678",
      }
}
```
 
x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
import java.nio.file.Path;
import java.util.Base64;
import java.util.List;
import java.util.Map;
import static org.hamcrest.Matchers.anEmptyMap;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.hasEntry;
import static org.hamcrest.Matchers.hasKey;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.nullValue;
public class ServiceAccountIT extends ESRestTestCase {
    private static final String VALID_SERVICE_TOKEN = "AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuMTpyNXdkYmRib1FTZTl2R09Ld2FKR0F3";
    private static final String INVALID_SERVICE_TOKEN = "AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuMTozYUpDTGFRV1JOMnNYbE9kdHhBMFNR";
    private static Path caPath;
    private static final String AUTHENTICATE_RESPONSE = """
        {
          "username": "elastic/fleet-server",
          "roles": [],
          "full_name": "Service account - elastic/fleet-server",
          "email": null,
          "token": {
            "name": "%s",
            "type": "_service_account_%s"
          },
          "metadata": {
            "_elastic_service_account": true
          },
          "enabled": true,
          "authentication_realm": {