### Description

Currently, when we execute retention policy, we also refresh the destination index by setting:
```
setRefresh(true)
```
on the DBQ request.
This can cause permission errors which are surprising to the user as the permissions are not required when the transform starts:
```
task encountered irrecoverable failure: org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/refresh] is unauthorized for user [found-internal-kibana4-server] with roles [kibana_system,found-internal-kibana4-server] on indices [logs-cloud_security_posture.findings_latest-default], this action is granted by the index privileges [maintenance,manage,all]
```

We still want the user to have the permissions to delete the documents. But we should execute `refresh` as the system user.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/TransformIndexer.java
protected boolean initialRun() {
        return getPosition() == null;
    }
    @Override
    protected void onFinish(ActionListener<Void> listener) {
        startIndexerThreadShutdown();
        
        
        if (hasSourceChanged == false) {
            if (context.shouldStopAtCheckpoint()) {
                stop();
            }
            listener.onResponse(null);
            return;
        }
        ActionListener<Void> failureHandlingListener = ActionListener.wrap(listener::onResponse, failure -> {
            handleFailure(failure);
            listener.onFailure(failure);
        });
        try {
            refreshDestinationIndex(ActionListener.wrap(response -> {
                if (response.getFailedShards() > 0) {
                    logger.warn(
                        "[{}] failed to refresh transform destination index, not all data might be available after checkpoint.",
                        getJobId()
                    );
                }
                
                if (transformConfig.getRetentionPolicyConfig() != null) {
                    executeRetentionPolicy(failureHandlingListener);