Part of https://github.com/elastic/kibana/issues/154715

The `.fleet-secrets` system index should just have a value key. 

Kibana system should only have write and delete access NOT read access.

Fleet server will have read access only. 

Example document:

```
// example document from the .fleet-secrets index 
{
	_id: 'abcd1234'
	_source: {
	   value: "abcd12345678",
      }
}
```
 
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java
RoleDescriptor.IndicesPrivileges.builder()
                    .indices("logs-cloud_security_posture.findings-*", "logs-cloud_security_posture.vulnerabilities-*")
                    .privileges("read", "view_index_metadata")
                    .build(),
                RoleDescriptor.IndicesPrivileges.builder()
                    .indices(
                        "logs-cloud_security_posture.findings_latest-default*",
                        "logs-cloud_security_posture.scores-default*",
                        "logs-cloud_security_posture.vulnerabilities_latest-default*"
                    )
                    .privileges("create_index", "read", "index", "delete", IndicesAliasesAction.NAME, UpdateSettingsAction.NAME)
                    .build() },
            null,
            new ConfigurableClusterPrivilege[] {
                new ManageApplicationPrivileges(Set.of("kibana-*")),
                new WriteProfileDataPrivileges(Set.of("kibana*")) },
            null,
            MetadataUtils.DEFAULT_RESERVED_METADATA,
            null,
            TcpTransport.isUntrustedRemoteClusterEnabled()
                ? new RoleDescriptor.RemoteIndicesPrivileges[] {
                    getRemoteIndicesReadPrivileges(".monitoring-*"),
                    getRemoteIndicesReadPrivileges("apm-*"),
                    getRemoteIndicesReadPrivileges("logs-apm.*"),
                    getRemoteIndicesReadPrivileges("metrics-apm.*"),
                    getRemoteIndicesReadPrivileges("traces-apm.*"),
                    getRemoteIndicesReadPrivileges("traces-apm-*") }
                : null
        );