[Feature]: Move single-role variables out of the elasticstack meta role #485

Describe the feature request

Following the naming-convention discussion in #159, role variables should be prefixed with
the role name and live in that role's defaults. Several elasticstack_* variables sit in
the elasticstack meta role but are read by only one role. Decide per variable: if it also
has no stack-wide meaning, move it to the consuming role (and drop the elasticstack_
prefix); if it is single-consumer but conceptually stack-wide, keep it central.

1. Move to the consuming role (single-role, no stack-wide meaning)

• repos: elasticstack_repo_url, elasticstack_repo_key, elasticstack_enable_repos, elasticstack_rpm_workaround
• elasticsearch: elasticstack_temperature (also tracked for renaming in Clean up small issues in the elasticsearch role #491)

2. Single-consumer but stack-wide — keep central (elasticstack_)

Only the elasticsearch role reads these, but they describe stack-wide concepts, so splitting
them out would be inconsistent and confusing:

• CA settings (elasticsearch manages the CA, but it secures the whole stack): elasticstack_ca_name, elasticstack_ca_validity_period, elasticstack_ca_expiration_buffer, elasticstack_ca_will_expire_soon
• elasticstack_kibana_group_name (part of the stack topology, like the other group names)

3. Shared (read by ≥2 roles) — keep central

variant, release, full_stack, ca_dir / ca_host / ca_pass, elasticsearch_group_name,
logstash_group_name, elasticsearch_http_port, no_log, initial_passwords, beats_port,
override_beats_tls, security, cert_pass (elasticsearch + kibana), version (all roles).

The single-role vs. shared classification was verified against the code during the elasticstack
documentation work (#475).

Renaming variables users may already set is a breaking change.