Replace the set_fact default of beats_ca_dir with a role default #571

beats_ca_dir has no role default. roles/beats/tasks/main.yml sets it with two set_fact tasks when it is undefined: /etc/beats/certs in a full stack if elasticstack_security is true, otherwise /opt/ca. So the default is missing from argument_specs.yml and the README, in a full stack it depends on elasticstack_security, and /opt/ca is the convention of the separate CA role, not of the Beats.

Set beats_ca_dir: /etc/beats/certs in defaults/main.yml for both variants, remove the two set_fact tasks and use {{ beats_ca_dir }} directly in the defaults of beats_tls_cert, beats_tls_key and beats_tls_cacert. Values from the inventory still override it.

Breaking: standalone setups that rely on /opt/ca without setting it have to set beats_ca_dir: /opt/ca.