Deprecate index audit output type

[albertzaharovits]

This PR deprecates the index audit output.
In general, the problem with it is that event indexing can be slower than the rate with which audit events are generated, especially during the daily rollovers or the rolling cluster upgrades. In this situation audit events will be lost which is a terrible failure case for an audit system.

I will follow-up with the removal PR for 7.0 .

Relates #29881

CC @ycombinator

[elasticmachine]

Pinging @elastic/es-security

[ycombinator]

The beats work to handle this deprecation is close to being done: elastic/beats#8852

[jaymode]

LGTM

[jaymode]

Sorry I was too quick with the LGTM. This should also add a check in NodeDeprecationChecks

[albertzaharovits]

Ah, right.
I was planning to add this in the follow-up 7.0 PR that actually removes the output type because the deprecation check will be admonishing that the output type has been removed. But the 7.0 PR does not touch the 6.x branch, yet the check has to sit in 6.x. I will add the check.

[albertzaharovits]

@jaymode I went for a new PR to add the NodeDeprecationChecks. The files for these are only stubs in master so I guess the idiomatic way to add these is a 6.x PR which I have opened here #37671 . I will follow with a master only PR to remove the output altogether and add the /migration/migrate_7_0/settings.asciidoc notice.