[Feature]: Introduce elasticstack_generate_passwords (collection-generated vs user-supplied credentials) #533

Another job hidden inside elasticstack_full_stack: whether the collection generates the built-in user passwords (elasticsearch-setup-passwords auto on the CA host) and fetches them for the other roles.

Add elasticstack_generate_passwords (default true). When false, the collection creates/fetches nothing and the user supplies each role's credentials via per-role variables (a standalone role against an external/cloud Elasticsearch the collection didn't bootstrap).

Note: password generation currently hangs on elasticsearch_security + the CA host, not on full_stack — this gives it its own explicit switch.

Breaking → 2.0.0. Part of #531.