Add Elastic Agent role

[Oddly]

The collection currently manages Filebeat, Metricbeat, and Auditbeat through the beats role but has no support for Elastic Agent, which is Elastic's recommended unified agent for data collection in 8.x and 9.x.

An elastic-agent role would handle installation, enrollment with Fleet Server or standalone configuration, policy management, and upgrades. This would bring the collection in line with Elastic's direction of converging beats into a single agent.

Scope would include:

• Package installation from the Elastic repository (already handled by the repos role)
• Fleet enrollment (fleet-server URL, enrollment token)
• Standalone configuration (elastic-agent.yml template)
• TLS certificate distribution (reusing the existing cert_distribute pattern)
• Service management and upgrade support
• Integration with the existing elasticsearch and kibana roles for Fleet Server setup

---

Merged from #15 — additional scope from that issue:

• Migration path from individual Beats to Elastic Agent
• Support for both 8.x and 9.x
• The Logstash role already has logstash_input_elastic_agent and logstash_input_elastic_agent_port variables for receiving data from Elastic Agent, so the pipeline side is partially ready.