### Description

Currently, when we execute retention policy, we also refresh the destination index by setting:
```
setRefresh(true)
```
on the DBQ request.
This can cause permission errors which are surprising to the user as the permissions are not required when the transform starts:
```
task encountered irrecoverable failure: org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/refresh] is unauthorized for user [found-internal-kibana4-server] with roles [kibana_system,found-internal-kibana4-server] on indices [logs-cloud_security_posture.findings_latest-default], this action is granted by the index privileges [maintenance,manage,all]
```

We still want the user to have the permissions to delete the documents. But we should execute `refresh` as the system user.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/TransformIndexer.java
return Collections.singletonList(shouldStopAtCheckpointListener);
                }
                return CollectionUtils.appendToCopy(currentListeners, shouldStopAtCheckpointListener);
            }) == null) {
                return false;
            }
            context.setShouldStopAtCheckpoint(shouldStopAtCheckpoint);
        }
        
        runSearchImmediately();
        return true;
    }
    void stopAndMaybeSaveState() {
        synchronized (context) {
            onStop();
            IndexerState state = stop();
            if (indexerThreadShuttingDown) {
                saveStateRequestedDuringIndexerThreadShutdown = true;
                
            } else if (state == IndexerState.STOPPED) {
                doSaveState(IndexerState.STOPPED, getPosition(), () -> {});
            }
        }
    }
    /**
     * Checks the given exception and handles the error based on it.
     *
     * In case the error is permanent or the number for failures exceed the number of retries, sets the indexer
     * to `FAILED`.
     *