### Description

Currently, when we execute retention policy, we also refresh the destination index by setting:
```
setRefresh(true)
```
on the DBQ request.
This can cause permission errors which are surprising to the user as the permissions are not required when the transform starts:
```
task encountered irrecoverable failure: org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/refresh] is unauthorized for user [found-internal-kibana4-server] with roles [kibana_system,found-internal-kibana4-server] on indices [logs-cloud_security_posture.findings_latest-default], this action is granted by the index privileges [maintenance,manage,all]
```

We still want the user to have the permissions to delete the documents. But we should execute `refresh` as the system user.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/TransformIndexer.java
if (context.shouldStopAtCheckpoint()) {
                stop();
            }
            if (checkpoint - lastCheckpointCleanup > CHECKPOINT_CLEANUP_INTERVAL) {
                
                cleanupOldCheckpoints(listener);
            } else {
                listener.onResponse(null);
            }
        } catch (Exception e) {
            listener.onFailure(e);
        }
    }
    @Override
    protected void afterFinishOrFailure() {
        finishIndexerThreadShutdown();
    }
    @Override
    protected IterationResult<TransformIndexerPosition> doProcess(SearchResponse searchResponse) {
        switch (runState) {
            case APPLY_RESULTS:
                return processBuckets(searchResponse);
            case IDENTIFY_CHANGES:
                return processChangedBuckets(searchResponse);
            default:
                
                logger.warn("[{}] Encountered unexpected run state [{}]", getJobId(), runState);
                throw new IllegalStateException("Transform indexer job encountered an illegal state [" + runState + "]");
        }
    }