Part of https://github.com/elastic/kibana/issues/154715

The `.fleet-secrets` system index should just have a value key. 

Kibana system should only have write and delete access NOT read access.

Fleet server will have read access only. 

Example document:

```
// example document from the .fleet-secrets index 
{
	_id: 'abcd1234'
	_source: {
	   value: "abcd12345678",
      }
}
```
 
x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
assertOK(getTokensResponse3);
        final Map<String, Object> getTokensResponseMap3 = responseAsMap(getTokensResponse3);
        assertThat(getTokensResponseMap3.get("service_account"), equalTo("elastic/fleet-server"));
        assertThat(getTokensResponseMap3.get("count"), equalTo(2));
        assertThat(getTokensResponseMap3.get("tokens"), equalTo(Map.of("api-token-1", Map.of())));
        assertNodesCredentials(getTokensResponseMap3);
        final Request deleteTokenRequest2 = new Request("DELETE", "_security/service/elastic/fleet-server/credential/token/non-such-thing");
        final ResponseException e2 = expectThrows(ResponseException.class, () -> client().performRequest(deleteTokenRequest2));
        assertThat(e2.getResponse().getStatusLine().getStatusCode(), equalTo(404));
        assertThat(EntityUtils.toString(e2.getResponse().getEntity()), equalTo("{\"found\":false}"));
    }
    public void testClearCache() throws IOException {
        final Request clearCacheRequest = new Request(
            "POST",
            "_security/service/elastic/fleet-server/credential/token/"
                + randomFrom("", "*", "api-token-1", "api-token-1,api-token2")
                + "/_clear_cache"
        );
        final Response clearCacheResponse = adminClient().performRequest(clearCacheRequest);
        assertOK(clearCacheResponse);
        final Map<String, Object> clearCacheResponseMap = responseAsMap(clearCacheResponse);
        @SuppressWarnings("unchecked")
        final Map<String, Object> nodesMap = (Map<String, Object>) clearCacheResponseMap.get("_nodes");
        assertThat(nodesMap.get("failed"), equalTo(0));
    }
    public void testManageOwnApiKey() throws IOException {
        final String token;
        if (randomBoolean()) {
            token = VALID_SERVICE_TOKEN;
        } else {