Part of https://github.com/elastic/kibana/issues/154715

The `.fleet-secrets` system index should just have a value key. 

Kibana system should only have write and delete access NOT read access.

Fleet server will have read access only. 

Example document:

```
// example document from the .fleet-secrets index 
{
	_id: 'abcd1234'
	_source: {
	   value: "abcd12345678",
      }
}
```
 
x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
assertOK(getServiceAccountResponseKibana);
        assertServiceAccountRoleDescriptor(
            getServiceAccountResponseKibana,
            "elastic/kibana",
            Strings.toString(
                ReservedRolesStore.kibanaSystemRoleDescriptor(KibanaSystemUser.ROLE_NAME)
                    .toXContent(JsonXContent.contentBuilder(), ToXContent.EMPTY_PARAMS)
            )
        );
        final Request getServiceAccountRequestEnterpriseSearchService = new Request(
            "GET",
            "_security/service/elastic/enterprise-search-server"
        );
        final Response getServiceAccountResponseEnterpriseSearchService = client().performRequest(
            getServiceAccountRequestEnterpriseSearchService
        );
        assertServiceAccountRoleDescriptor(
            getServiceAccountResponseEnterpriseSearchService,
            "elastic/enterprise-search-server",
            ELASTIC_ENTERPRISE_SEARCH_SERVER_ROLE_DESCRIPTOR
        );
        final String requestPath = "_security/service/" + randomFrom("foo", "elastic/foo", "foo/bar");
        final Request getServiceAccountRequest4 = new Request("GET", requestPath);
        final Response getServiceAccountResponse4 = client().performRequest(getServiceAccountRequest4);
        assertOK(getServiceAccountResponse4);
        assertThat(responseAsMap(getServiceAccountResponse4), anEmptyMap());
    }
    public void testAuthenticate() throws IOException {
        final Request request = new Request("GET", "_security/_authenticate");
        request.setOptions(RequestOptions.DEFAULT.toBuilder().addHeader("Authorization", "Bearer " + VALID_SERVICE_TOKEN));