[Feature]: Logstash — opt-in client certificate to Elasticsearch (mTLS), split from cacert/auth #539

The Logstash ES output (elasticsearch-output.conf.j2) bundles keystore (client cert), cacert (server verification) and user/password (auth) under one flag — and the keystore is shipped even though ES does not request a client cert, so it is ignored today.

Separate the concerns: cacert / ssl_certificate_authorities (the client verifying the ES server — needed for any TLS, docs) stays on the TLS axis; the keystore / ssl_keystore_path (Logstash's own client certificate) becomes an opt-in mTLS flag.

Depends on: the ES-side enabler xpack.security.http.ssl.client_authentication (#536) and the Logstash TLS axis logstash_tls (#529). Overlaps #529 — both restructure the same ES-output block, so coordinate. Opt-in, default off. Part of #536. 2.0.0.