[Feature]: Introduce elasticstack_manage_ca (collection-managed CA vs bring-your-own) #532

One job hidden inside elasticstack_full_stack: whether the collection acts as its own Certificate Authority — generating the CA with elasticsearch-certutil and distributing ca.crt + node/component certificates across the roles.

Add elasticstack_manage_ca (default true) to control exactly this. When false, the collection generates/distributes nothing and the user brings their own CA/certificates via the existing *_tls_* variables (externally-managed or cloud stack). Decouples "collection owns the PKI" from "collection deploys the components".

Breaking → 2.0.0. Part of #531.