[Feature]: Beats — opt-in client certificate to Elasticsearch (mTLS) #538

Beats currently present a client certificate only to Logstash (Logstash enforces it with ssl_verify_mode => force_peer), not to Elasticsearch — so beats→ES is one-way TLS + password.

Add an opt-in that makes Beats present a client certificate on the Elasticsearch output (ssl.certificate + ssl.key), for mutual TLS. ssl.certificate_authorities (server verification) is unchanged and stays on the TLS side.

Depends on: the ES-side enabler xpack.security.http.ssl.client_authentication (see #536 — else ES ignores the cert) and the Beats TLS axis beats_tls (#528). Opt-in, default off. Part of #536. 2.0.0.