Add more meaningful keystore version mismatch errors

This commit changes the version bounds of keystore reading to give
better error messages when a user has a too new or too old format.

relates elastic#44624

server/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java

@@ -217,7 +217,14 @@ public static KeyStoreWrapper load(Path configDir) throws IOException {
         SimpleFSDirectory directory = new SimpleFSDirectory(configDir);
         try (IndexInput indexInput = directory.openInput(KEYSTORE_FILENAME, IOContext.READONCE)) {
             ChecksumIndexInput input = new BufferedChecksumIndexInput(indexInput);
-            int formatVersion = CodecUtil.checkHeader(input, KEYSTORE_FILENAME, MIN_FORMAT_VERSION, FORMAT_VERSION);
+            int formatVersion = CodecUtil.checkHeader(input, KEYSTORE_FILENAME, 0, Integer.MAX_VALUE);
+            if (formatVersion < MIN_FORMAT_VERSION) {
+                throw new IllegalStateException("The Elasticsearch keystore format is too old. " +
+                    "You should delete and recreate it in order to upgrade.");
+            } else if (formatVersion > FORMAT_VERSION) {
+                throw new IllegalStateException("The Elasticsearch keystore format is too new. Are you trying to downgrade? " +
+                    "You should delete and recreate it in order to downgrade.");
+            }
             byte hasPasswordByte = input.readByte();
             boolean hasPassword = hasPasswordByte == 1;
             if (hasPassword == false && hasPasswordByte != 0) {