### Description

**Background**
As part of https://github.com/elastic/kibana/issues/104986 we will be adding the ability for Elastic Agents to send agent monitoring data to a remote Elasticsearch cluster. In order to achieve this, we will need a service token for the remote cluster which fleet server will use. 

This service account will need less permissions than the `elastic/fleet-server` as integration data will not be sent to remote clusters yet.

**Service Account Details**

Name: `elastic/fleet-server-remote`

Permissions:
-  for indices `logs-*`, `metrics-*` privileges "write", "create_index", "auto_configure"

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountServiceTests.java
appender.assertAllExpectationsMatched();
            
            final ServiceAccountId accountId2 = new ServiceAccountId(
                ElasticServiceAccounts.NAMESPACE,
                randomValueOtherThan("fleet-server", () -> randomAlphaOfLengthBetween(3, 8))
            );
            appender.addExpectation(
                new MockLogAppender.SeenEventExpectation(
                    "unknown elastic service name",
                    ServiceAccountService.class.getName(),
                    Level.DEBUG,
                    "the [" + accountId2.asPrincipal() + "] service account does not exist"
                )
            );
            final ServiceAccountToken token2 = new ServiceAccountToken(accountId2, randomAlphaOfLengthBetween(3, 8), secret);
            final PlainActionFuture<Authentication> future2 = new PlainActionFuture<>();
            serviceAccountService.authenticateToken(token2, randomAlphaOfLengthBetween(3, 8), future2);
            final ExecutionException e2 = expectThrows(ExecutionException.class, future2::get);
            assertThat(e2.getCause().getClass(), is(ElasticsearchSecurityException.class));
            assertThat(
                e2.getMessage(),
                containsString(
                    "failed to authenticate service account ["
                        + token2.getAccountId().asPrincipal()
                        + "] with token name ["
                        + token2.getTokenName()
                        + "]"
                )
            );
            appender.assertAllExpectationsMatched();