Part of https://github.com/elastic/kibana/issues/154715

The `.fleet-secrets` system index should just have a value key. 

Kibana system should only have write and delete access NOT read access.

Fleet server will have read access only. 

Example document:

```
// example document from the .fleet-secrets index 
{
	_id: 'abcd1234'
	_source: {
	   value: "abcd12345678",
      }
}
```
 
x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
final Response response = client().performRequest(request);
        assertOK(response);
        assertThat(
            responseAsMap(response),
            equalTo(
                XContentHelper.convertToMap(
                    new BytesArray(Strings.format(AUTHENTICATE_RESPONSE, "token1", "file")),
                    false,
                    XContentType.JSON
                ).v2()
            )
        );
    }
    public void testAuthenticateShouldNotFallThroughInCaseOfFailure() throws IOException {
        final boolean securityIndexExists = randomBoolean();
        if (securityIndexExists) {
            final Request createRoleRequest = new Request("POST", "_security/role/dummy_role");
            createRoleRequest.setJsonEntity("{\"cluster\":[]}");
            assertOK(adminClient().performRequest(createRoleRequest));
        }
        final Request request = new Request("GET", "_security/_authenticate");
        request.setOptions(RequestOptions.DEFAULT.toBuilder().addHeader("Authorization", "Bearer " + INVALID_SERVICE_TOKEN));
        final ResponseException e = expectThrows(ResponseException.class, () -> client().performRequest(request));
        assertThat(e.getResponse().getStatusLine().getStatusCode(), equalTo(401));
        if (securityIndexExists) {
            assertThat(
                e.getMessage(),
                containsString("failed to authenticate service account [elastic/fleet-server] with token name [token1]")
            );
        } else {