### Description

**Background**
As part of https://github.com/elastic/kibana/issues/104986 we will be adding the ability for Elastic Agents to send agent monitoring data to a remote Elasticsearch cluster. In order to achieve this, we will need a service token for the remote cluster which fleet server will use. 

This service account will need less permissions than the `elastic/fleet-server` as integration data will not be sent to remote clusters yet.

**Service Account Details**

Name: `elastic/fleet-server-remote`

Permissions:
-  for indices `logs-*`, `metrics-*` privileges "write", "create_index", "auto_configure"

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountServiceTests.java
try {
            
            final ServiceAccountId accountId1 = new ServiceAccountId(
                randomValueOtherThan(ElasticServiceAccounts.NAMESPACE, () -> randomAlphaOfLengthBetween(3, 8)),
                randomAlphaOfLengthBetween(3, 8)
            );
            appender.addExpectation(
                new MockLogAppender.SeenEventExpectation(
                    "non-elastic service account",
                    ServiceAccountService.class.getName(),
                    Level.DEBUG,
                    "only [elastic] service accounts are supported, but received [" + accountId1.asPrincipal() + "]"
                )
            );
            final SecureString secret = new SecureString(randomAlphaOfLength(20).toCharArray());
            final ServiceAccountToken token1 = new ServiceAccountToken(accountId1, randomAlphaOfLengthBetween(3, 8), secret);
            final PlainActionFuture<Authentication> future1 = new PlainActionFuture<>();
            serviceAccountService.authenticateToken(token1, randomAlphaOfLengthBetween(3, 8), future1);
            final ExecutionException e1 = expectThrows(ExecutionException.class, future1::get);
            assertThat(e1.getCause().getClass(), is(ElasticsearchSecurityException.class));
            assertThat(
                e1.getMessage(),
                containsString(
                    "failed to authenticate service account ["
                        + token1.getAccountId().asPrincipal()
                        + "] with token name ["
                        + token1.getTokenName()
                        + "]"
                )
            );